From fa903f40fd62e01a244733c29b4234f82d4598cb Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 19:39:12 +0000 Subject: [PATCH] fix(bank_statement_import): add missing permission check on multiple whitelisted methods (backport #58221) (#58223) Co-authored-by: Diptanil Saha --- .../bank_statement_import.py | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py b/erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py index db68b6d894d..2cd076c2286 100644 --- a/erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py +++ b/erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py @@ -105,25 +105,30 @@ class BankStatementImport(DataImport): @frappe.whitelist() def get_preview_from_template(data_import, import_file=None, google_sheets_url=None): - return frappe.get_doc("Bank Statement Import", data_import).get_preview_from_template( - import_file, google_sheets_url - ) + bsi = frappe.get_doc("Bank Statement Import", data_import) + bsi.check_permission() + return bsi.get_preview_from_template(import_file, google_sheets_url) @frappe.whitelist() def form_start_import(data_import): - return frappe.get_doc("Bank Statement Import", data_import).start_import() + bsi = frappe.get_doc("Bank Statement Import", data_import) + bsi.check_permission("write") + return bsi.start_import() @frappe.whitelist() def download_errored_template(data_import_name): data_import = frappe.get_doc("Bank Statement Import", data_import_name) + data_import.check_permission() data_import.export_errored_rows() @frappe.whitelist() def download_import_log(data_import_name): - return frappe.get_doc("Bank Statement Import", data_import_name).download_import_log() + bsi = frappe.get_doc("Bank Statement Import", data_import_name) + bsi.check_permission() + return bsi.download_import_log() def parse_data_from_template(raw_data):