nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-08-14 07:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: use new_doc with field allowlist in CRM integration endpoints

Browse Source 
(cherry picked from commit e460e83516)
This commit is contained in:
Shllokkk
2026-05-31 18:42:26 +05:30
committed by Mergify
parent ecd3a19912
commit d941ccfe3c
1 changed files with 27 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
erpnext/crm/frappe_crm_api.py
View File

@@ -32,20 +32,16 @@ def create_custom_fields_for_frappe_crm():
@frappe.whitelist() @frappe.whitelist()
def create_prospect_against_crm_deal(): def create_prospect_against_crm_deal():
doc = frappe.form_dict doc = frappe.form_dict
prospect = frappe.get_doc( prospect = frappe.new_doc("Prospect")
{ prospect.company_name = doc.organization or doc.lead_name
"doctype": "Prospect", prospect.no_of_employees = doc.no_of_employees
"company_name": doc.organization or doc.lead_name, prospect.prospect_owner = doc.deal_owner
"no_of_employees": doc.no_of_employees, prospect.company = doc.erpnext_company
"prospect_owner": doc.deal_owner, prospect.crm_deal = doc.crm_deal
"company": doc.erpnext_company, prospect.territory = doc.territory
"crm_deal": doc.crm_deal, prospect.industry = doc.industry
"territory": doc.territory, prospect.website = doc.website
"industry": doc.industry, prospect.annual_revenue = doc.annual_revenue
"website": doc.website,
"annual_revenue": doc.annual_revenue,
}
)
try: try:
prospect_name = frappe.db.get_value("Prospect", {"company_name": prospect.company_name}) prospect_name = frappe.db.get_value("Prospect", {"company_name": prospect.company_name})
@@ -151,6 +147,18 @@ def contact_exists(email, mobile_no):
return False return False
CUSTOMER_ALLOWED_FIELDS = {
"customer_name",
"customer_group",
"customer_type",
"territory",
"default_currency",
"industry",
"website",
"crm_deal",
}
@frappe.whitelist() @frappe.whitelist()
def create_customer(customer_data=None): def create_customer(customer_data=None):
if not customer_data: if not customer_data:
@@ -159,9 +167,11 @@ def create_customer(customer_data=None):
try: try:
customer_name = frappe.db.exists("Customer", {"customer_name": customer_data.get("customer_name")}) customer_name = frappe.db.exists("Customer", {"customer_name": customer_data.get("customer_name")})
if not customer_name: if not customer_name:
customer = frappe.get_doc({"doctype": "Customer", **customer_data}).insert( customer = frappe.new_doc("Customer")
ignore_permissions=True for field in CUSTOMER_ALLOWED_FIELDS:
) if customer_data.get(field) is not None:
customer.set(field, customer_data.get(field))
customer.insert(ignore_permissions=True)
customer_name = customer.name customer_name = customer.name
contacts = json.loads(customer_data.get("contacts")) contacts = json.loads(customer_data.get("contacts"))