From d95eeb0f6a30152c457543857a41c17e7ec9346d Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 17:14:16 +0530 Subject: [PATCH] fix(pos): add permission checks on `get_invoices` (backport #58591) (#58597) Co-authored-by: Diptanil Saha --- .../accounts/doctype/pos_closing_entry/pos_closing_entry.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py b/erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py index 7b2b9e922bd..6c01a3ed202 100644 --- a/erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py +++ b/erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py @@ -261,12 +261,15 @@ def get_cashiers(doctype, txt, searchfield, start, page_len, filters): @frappe.whitelist() def get_invoices(start, end, pos_profile, user): invoice_doctype = frappe.db.get_single_value("POS Settings", "invoice_type") + frappe.has_permission("POS Profile", doc=pos_profile, throw=True) + frappe.has_permission("Sales Invoice", throw=True) sales_inv_query = build_invoice_query("Sales Invoice", user, pos_profile, start, end) query = sales_inv_query if invoice_doctype == "POS Invoice": + frappe.has_permission("POS Invoice", throw=True) pos_inv_query = build_invoice_query("POS Invoice", user, pos_profile, start, end) query = query + pos_inv_query