From eb49f51d29330bec3761d69c0ca12a79bce14fb0 Mon Sep 17 00:00:00 2001 From: Shllokkk Date: Fri, 21 Aug 2026 13:18:26 +0530 Subject: [PATCH] fix(crm): check write permission in edit_note --- erpnext/crm/utils.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/erpnext/crm/utils.py b/erpnext/crm/utils.py index 0652db3333a..1a0ccbba265 100644 --- a/erpnext/crm/utils.py +++ b/erpnext/crm/utils.py @@ -256,6 +256,9 @@ class CRMNote(Document): @frappe.whitelist() def edit_note(self, note: str, row_id: str): + # db_update() skips the write check that save() does in add_note/delete_note + self.check_permission("write") + for d in self.notes: if cstr(d.name) == row_id: d.note = note