From 09d721d1be80eca48edbc6ed52676febc329cc90 Mon Sep 17 00:00:00 2001 From: diptanilsaha Date: Thu, 16 Jul 2026 00:47:56 +0530 Subject: [PATCH 1/3] fix(assets): add permission checks on whitelisted methods on `asset_capitalization` --- .../doctype/asset_capitalization/asset_capitalization.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/erpnext/assets/doctype/asset_capitalization/asset_capitalization.py b/erpnext/assets/doctype/asset_capitalization/asset_capitalization.py index 5ffaa6dc74e..14f3f1befec 100644 --- a/erpnext/assets/doctype/asset_capitalization/asset_capitalization.py +++ b/erpnext/assets/doctype/asset_capitalization/asset_capitalization.py @@ -539,11 +539,13 @@ def get_target_asset_details(asset: str | None = None, company: str | None = Non @frappe.whitelist() @erpnext.normalize_ctx_input(ItemDetailsCtx) def get_consumed_stock_item_details(ctx: ItemDetailsCtx): + frappe.has_permission("Stock Ledger Entry", throw=True) out = frappe._dict() item = frappe._dict() if ctx.item_code: item = frappe.get_cached_doc("Item", ctx.item_code) + item.check_permission() out.item_name = item.item_name out.batch_no = None @@ -553,6 +555,8 @@ def get_consumed_stock_item_details(ctx: ItemDetailsCtx): out.stock_uom = item.stock_uom out.warehouse = get_item_warehouse_(ctx, item, overwrite_warehouse=True) if item else None + if out.warehouse: + frappe.has_permission("Warehouse", doc=out.warehouse, throw=True) # Cost Center item_defaults = get_item_defaults(item.name, ctx.company) @@ -589,6 +593,9 @@ def get_consumed_stock_item_details(ctx: ItemDetailsCtx): def get_warehouse_details(ctx: ItemDetailsCtx) -> frappe._dict: out = frappe._dict() if ctx.warehouse and ctx.item_code: + frappe.has_permission("Item", doc=ctx.item_code, throw=True) + frappe.has_permission("Warehouse", doc=ctx.warehouse, throw=True) + frappe.has_permission("Stock Ledger Entry", throw=True) out = frappe._dict( { "actual_qty": get_previous_sle(ctx).get("qty_after_transaction") or 0, From 3b0cbc972eae6b1c062b42c03406406b3de687cd Mon Sep 17 00:00:00 2001 From: diptanilsaha Date: Wed, 15 Jul 2026 23:23:48 +0530 Subject: [PATCH 2/3] fix(item_variant): added permission checks on `enqueue_multiple_variant_creation` --- erpnext/controllers/item_variant.py | 1 + 1 file changed, 1 insertion(+) diff --git a/erpnext/controllers/item_variant.py b/erpnext/controllers/item_variant.py index 3e4f632307e..3c4f4cb5dfd 100644 --- a/erpnext/controllers/item_variant.py +++ b/erpnext/controllers/item_variant.py @@ -346,6 +346,7 @@ def create_variant(item: str, args: dict | str, use_template_image: bool = False def enqueue_multiple_variant_creation(item: str, args: dict | str, use_template_image: bool = False): use_template_image = frappe.parse_json(use_template_image) # There can be innumerable attribute combinations, enqueue + frappe.has_permission("Item", ptype="create", throw=True) variants = frappe.parse_json(args) variants = {key: values for key, values in variants.items() if values} if not variants: From 0659bd704968543d95af0ba225c5e3aa4a29d987 Mon Sep 17 00:00:00 2001 From: diptanilsaha Date: Thu, 16 Jul 2026 01:10:50 +0530 Subject: [PATCH 3/3] fix(payment_request): added permission checks on `resend_payment_email` --- .../payment_request/payment_request.js | 22 ++++++++++--------- .../payment_request/payment_request.py | 20 ++++++++++++----- 2 files changed, 27 insertions(+), 15 deletions(-) diff --git a/erpnext/accounts/doctype/payment_request/payment_request.js b/erpnext/accounts/doctype/payment_request/payment_request.js index 9696a6bfc2a..31963793da2 100644 --- a/erpnext/accounts/doctype/payment_request/payment_request.js +++ b/erpnext/accounts/doctype/payment_request/payment_request.js @@ -37,6 +37,8 @@ frappe.ui.form.on("Payment Request", "refresh", function (frm) { frm.set_intro(__("Failure: {0}", [frm.doc.failed_reason]), "red"); } + let sending_email = false; + if ( frm.doc.payment_request_type == "Inward" && frm.doc.payment_channel !== "Phone" && @@ -45,16 +47,16 @@ frappe.ui.form.on("Payment Request", "refresh", function (frm) { frm.doc.docstatus == 1 ) { frm.add_custom_button(__("Resend Payment Email"), function () { - frappe.call({ - method: "erpnext.accounts.doctype.payment_request.payment_request.resend_payment_email", - args: { docname: frm.doc.name }, - freeze: true, - freeze_message: __("Sending"), - callback: function (r) { - if (!r.exc) { - frappe.msgprint(__("Message Sent")); - } - }, + if (sending_email) { + frappe.show_alert({ message: __("Sending Email"), indicator: "blue" }); + return; + } + sending_email = true; + frappe.show_alert({ message: __("Sending Email"), indicator: "blue" }); + frm.call("resend_payment_email").then((r) => { + const msg = !r.exc ? __("Email Sent") : __("Email couldn't be sent."); + frappe.show_alert({ message: msg, indicator: !r.exc ? "green" : "red" }); + sending_email = false; }); }); } diff --git a/erpnext/accounts/doctype/payment_request/payment_request.py b/erpnext/accounts/doctype/payment_request/payment_request.py index d71af8bc677..f1702dddfe1 100644 --- a/erpnext/accounts/doctype/payment_request/payment_request.py +++ b/erpnext/accounts/doctype/payment_request/payment_request.py @@ -584,6 +584,18 @@ class PaymentRequest(Document): return payment_entry + @frappe.whitelist(methods=["POST"]) + def resend_payment_email(self): + if not ( + self.docstatus == 1 + and self.payment_request_type == "Inward" + and self.payment_channel != "Phone" + and self.status not in ["Initiated", "Paid"] + ): + frappe.throw(_("Payment Link couldn't be sent.")) + + self.send_email() + def send_email(self): """send email with payment link""" email_args = { @@ -601,11 +613,14 @@ class PaymentRequest(Document): ) ], } + job_id = f"send_payment_email::{self.name}" enqueue( method=frappe.sendmail, queue="short", timeout=300, is_async=True, + job_id=job_id, + deduplicate=True, enqueue_after_commit=True, **email_args, ) @@ -1109,11 +1124,6 @@ def get_print_format_list(ref_doctype: str): return {"print_format": print_format_list} -@frappe.whitelist() -def resend_payment_email(docname: str): - return frappe.get_doc("Payment Request", docname).send_email() - - @frappe.whitelist() def make_payment_entry(docname: str): doc = frappe.get_doc("Payment Request", docname)