nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-04-13 20:05:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: validate permission before updating status (backport #53651) (#53652)

Browse Source 
* fix: validate permission before updating status (#53651)

(cherry picked from commit 8e17c722fb)

# Conflicts:
#	erpnext/buying/doctype/purchase_order/purchase_order.py
#	erpnext/selling/doctype/sales_order/sales_order.py
#	erpnext/stock/doctype/purchase_receipt/purchase_receipt.py

* chore: resolve conflicts

---------

Co-authored-by: diptanilsaha <diptanil@frappe.io>
This commit is contained in:
mergify[bot]
2026-03-19 20:49:53 +05:30
committed by GitHub
parent ff11429941
commit defa1d4a76
3 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
erpnext/buying/doctype/purchase_order/purchase_order.py
View File

@@ -912,6 +912,8 @@ def get_list_context(context=None):
@frappe.whitelist() @frappe.whitelist()
def update_status(status, name): def update_status(status, name):
frappe.has_permission("Purchase Order", "write", name, throw=True)
po = frappe.get_doc("Purchase Order", name) po = frappe.get_doc("Purchase Order", name)
po.update_status(status) po.update_status(status)
po.update_delivered_qty_in_sales_order() po.update_delivered_qty_in_sales_order()

2
erpnext/selling/doctype/sales_order/sales_order.py
View File

@@ -1681,6 +1681,8 @@ def make_work_orders(items, sales_order, company, project=None):
@frappe.whitelist() @frappe.whitelist()
def update_status(status, name): def update_status(status, name):
frappe.has_permission("Sales Order", "write", name, throw=True)
so = frappe.get_doc("Sales Order", name) so = frappe.get_doc("Sales Order", name)
so.update_status(status) so.update_status(status)

2
erpnext/stock/doctype/purchase_receipt/purchase_receipt.py
View File

@@ -1414,6 +1414,8 @@ def make_purchase_return(source_name, target_doc=None):
@frappe.whitelist() @frappe.whitelist()
def update_purchase_receipt_status(docname, status): def update_purchase_receipt_status(docname, status):
frappe.has_permission("Purchase Receipt", "write", docname, throw=True)
pr = frappe.get_doc("Purchase Receipt", docname) pr = frappe.get_doc("Purchase Receipt", docname)
pr.update_status(status) pr.update_status(status)