nsinnovations/erpnext
2
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-09-09 15:29:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(bank_statement_import): add missing permission check on multiple whitelisted methods (backport #58221) (#58223)

Browse Source 
Co-authored-by: Diptanil Saha <diptanil@frappe.io>
This commit is contained in:
mergify[bot]
2026-08-31 19:39:12 +00:00
committed by GitHub
parent c5bc5f9c31
commit fa903f40fd
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py
View File

@@ -105,25 +105,30 @@ class BankStatementImport(DataImport):
@frappe.whitelist() @frappe.whitelist()
def get_preview_from_template(data_import, import_file=None, google_sheets_url=None): def get_preview_from_template(data_import, import_file=None, google_sheets_url=None):
return frappe.get_doc("Bank Statement Import", data_import).get_preview_from_template( bsi = frappe.get_doc("Bank Statement Import", data_import)
import_file, google_sheets_url bsi.check_permission()
) return bsi.get_preview_from_template(import_file, google_sheets_url)
@frappe.whitelist() @frappe.whitelist()
def form_start_import(data_import): def form_start_import(data_import):
return frappe.get_doc("Bank Statement Import", data_import).start_import() bsi = frappe.get_doc("Bank Statement Import", data_import)
bsi.check_permission("write")
return bsi.start_import()
@frappe.whitelist() @frappe.whitelist()
def download_errored_template(data_import_name): def download_errored_template(data_import_name):
data_import = frappe.get_doc("Bank Statement Import", data_import_name) data_import = frappe.get_doc("Bank Statement Import", data_import_name)
data_import.check_permission()
data_import.export_errored_rows() data_import.export_errored_rows()
@frappe.whitelist() @frappe.whitelist()
def download_import_log(data_import_name): def download_import_log(data_import_name):
return frappe.get_doc("Bank Statement Import", data_import_name).download_import_log() bsi = frappe.get_doc("Bank Statement Import", data_import_name)
bsi.check_permission()
return bsi.download_import_log()
def parse_data_from_template(raw_data): def parse_data_from_template(raw_data):