From e8a532587d0af6bb710c0ea6fe7ca8fea4e140b5 Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 13:07:12 +0530 Subject: [PATCH] fix(accounts): added permission checks on `get_account_balances_coa` (backport #57107) (#57122) Co-authored-by: Diptanil Saha --- erpnext/accounts/utils.py | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/erpnext/accounts/utils.py b/erpnext/accounts/utils.py index c5ac2d1cba2..37aa943f447 100644 --- a/erpnext/accounts/utils.py +++ b/erpnext/accounts/utils.py @@ -1408,13 +1408,11 @@ def get_account_balances(accounts, company, finance_book=None, include_default_f def get_account_balances_coa(company: str, include_default_fb_balances: bool = False): company_currency = frappe.get_cached_value("Company", company, "default_currency") - Account = DocType("Account") - account_list = ( - frappe.qb.from_(Account) - .select(Account.name, Account.parent_account, Account.account_currency) - .where(Account.company == company) - .orderby(Account.lft) - .run(as_dict=True) + account_list = frappe.get_list( + "Account", + fields=["name", "parent_account", "account_currency"], + filters={"company": company}, + order_by="lft", ) account_balances_cc = {account.get("name"): 0 for account in account_list} @@ -1424,9 +1422,8 @@ def get_account_balances_coa(company: str, include_default_fb_balances: bool = F GLEntry = DocType("GL Entry") precision = get_currency_precision() get_ledger_balances_query = ( - frappe.qb.from_(GLEntry) + frappe.get_query(GLEntry, fields=[GLEntry.account], ignore_permissions=False) .select( - GLEntry.account, (Sum(Round(GLEntry.debit, precision)) - Sum(Round(GLEntry.credit, precision))).as_("balance"), ( Sum(Round(GLEntry.debit_in_account_currency, precision)) @@ -1436,7 +1433,7 @@ def get_account_balances_coa(company: str, include_default_fb_balances: bool = F .groupby(GLEntry.account) ) - condition_list = [GLEntry.company == company, GLEntry.is_cancelled == 0] + conditions = [GLEntry.company == company, GLEntry.is_cancelled == 0] default_finance_book = None @@ -1444,12 +1441,9 @@ def get_account_balances_coa(company: str, include_default_fb_balances: bool = F default_finance_book = frappe.get_cached_value("Company", company, "default_finance_book") if default_finance_book: - condition_list.append( - (GLEntry.finance_book == default_finance_book) | (GLEntry.finance_book.isnull()) - ) + conditions.append((GLEntry.finance_book == default_finance_book) | (GLEntry.finance_book.isnull())) - for condition in condition_list: - get_ledger_balances_query = get_ledger_balances_query.where(condition) + get_ledger_balances_query = get_ledger_balances_query.where(Criterion.all(conditions)) ledger_balances = get_ledger_balances_query.run(as_dict=True)