nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-09-09 15:29:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(pos): add permission checks on get_invoices (backport #58591) (#58597)

Browse Source 
Co-authored-by: Diptanil Saha <diptanil@frappe.io>
This commit is contained in:
mergify[bot]
2026-08-31 17:14:16 +05:30
committed by GitHub
parent c7582e986d
commit d95eeb0f6a
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py
View File

@@ -261,12 +261,15 @@ def get_cashiers(doctype, txt, searchfield, start, page_len, filters):
@frappe.whitelist() @frappe.whitelist()
def get_invoices(start, end, pos_profile, user): def get_invoices(start, end, pos_profile, user):
invoice_doctype = frappe.db.get_single_value("POS Settings", "invoice_type") invoice_doctype = frappe.db.get_single_value("POS Settings", "invoice_type")
frappe.has_permission("POS Profile", doc=pos_profile, throw=True)
frappe.has_permission("Sales Invoice", throw=True)
sales_inv_query = build_invoice_query("Sales Invoice", user, pos_profile, start, end) sales_inv_query = build_invoice_query("Sales Invoice", user, pos_profile, start, end)
query = sales_inv_query query = sales_inv_query
if invoice_doctype == "POS Invoice": if invoice_doctype == "POS Invoice":
frappe.has_permission("POS Invoice", throw=True)
pos_inv_query = build_invoice_query("POS Invoice", user, pos_profile, start, end) pos_inv_query = build_invoice_query("POS Invoice", user, pos_profile, start, end)
query = query + pos_inv_query query = query + pos_inv_query