chore(release): Bumped to Version 15.121.4

## [15.121.4](https://github.com/frappe/erpnext/compare/v15.121.3...v15.121.4) (2026-09-23)

### Bug Fixes

* **accounts:** clarify revaluation journal filters ([a602153](a602153753))
* **accounts:** keep price list within user permissions ([#59231](https://github.com/frappe/erpnext/issues/59231)) ([004633a](004633a97e))
* apply journal entry reversal backport to version 15 controller ([5237c81](5237c8189a))
* clear stock value for zero-quantity balances ([#58899](https://github.com/frappe/erpnext/issues/58899)) ([65d2a07](65d2a07596))
* continuous raw material consumption with bom validation (backport [#51914](https://github.com/frappe/erpnext/issues/51914)) ([#59314](https://github.com/frappe/erpnext/issues/59314)) ([7fe230a](7fe230ac6e))
* do not zero out backdated stock at a stock reco adjustment entry ([#59271](https://github.com/frappe/erpnext/issues/59271)) ([1017286](10172869fe))
* **journal-entry:** carry reference fields into reverse journal entry ([f4ce7b2](f4ce7b2677))
* **manufacturing:** finish a work order after partial material consumption ([#59311](https://github.com/frappe/erpnext/issues/59311)) ([6d3304d](6d3304d3ec))
* negative stock value for moving average item with mixed batchwise valuation ([#59102](https://github.com/frappe/erpnext/issues/59102)) ([a37725b](a37725b6b9))
* **permissions:** grant select on link targets to roles with write access ([#59232](https://github.com/frappe/erpnext/issues/59232)) ([89de899](89de899c95))
* **pos:** quote the reversed row's rate on a consolidated credit note (backport [#59320](https://github.com/frappe/erpnext/issues/59320)) ([#59322](https://github.com/frappe/erpnext/issues/59322)) ([879c5c7](879c5c72a1))
* prevent max recursion on supplier scorecard save ([#58706](https://github.com/frappe/erpnext/issues/58706)) ([a7aae8b](a7aae8b21a))
* render letter head jinja in statement of accounts pdf ([b8a53b8](b8a53b800a))
* resolve code lists by URI and version (backport [#58770](https://github.com/frappe/erpnext/issues/58770)) ([#58771](https://github.com/frappe/erpnext/issues/58771)) ([e283008](e2830089fb))
* resolve conflicts ([32c8a95](32c8a9507d))
* resolve conflicts ([ed33afd](ed33afd0fa))
* round running allocation balance in payment reconciliation (backport [#58393](https://github.com/frappe/erpnext/issues/58393)) ([#59356](https://github.com/frappe/erpnext/issues/59356)) ([3a7d756](3a7d756714))
* **selling:** use preferred addresses in customer quotations ([e291ce2](e291ce2616))
* **stock:** allow None for for_validate in get_item_details ([#59290](https://github.com/frappe/erpnext/issues/59290)) ([a41858a](a41858a47d))
* **stock:** allow zero completed quantity and handle process loss in job cards ([#59104](https://github.com/frappe/erpnext/issues/59104)) ([1e862b2](1e862b232c))
* **stock:** apply transit warehouse filter to target warehouse in items table ([#59192](https://github.com/frappe/erpnext/issues/59192)) ([e139084](e13908400b))
* **stock:** calculate batch bundle valuation per unit ([#58994](https://github.com/frappe/erpnext/issues/58994)) ([7df94d8](7df94d87de))
* **stock:** compare transit quantities in stock UOM (backport [#59202](https://github.com/frappe/erpnext/issues/59202)) ([#59243](https://github.com/frappe/erpnext/issues/59243)) ([7d5293e](7d5293e83e))
* **stock:** continue putaway allocation after undersized whole-uom rules ([#59155](https://github.com/frappe/erpnext/issues/59155)) ([e693031](e6930317ae))
* **stock:** deduct rejected qty from the in-transit warehouse ([#59300](https://github.com/frappe/erpnext/issues/59300)) ([83ab572](83ab572208))
* **stock:** filter item group defaults by company and non-group records ([#58923](https://github.com/frappe/erpnext/issues/58923)) ([50b6b85](50b6b850e4))
* **stock:** forward company to outward batch lookup ([#59160](https://github.com/frappe/erpnext/issues/59160)) ([f5f7d04](f5f7d04fd5))
* **stock:** keep mapped cost center in stock entry items ([#59286](https://github.com/frappe/erpnext/issues/59286)) ([091fcfe](091fcfee7e))
* **stock:** use net purchase values in landed cost vouchers (backport [#59274](https://github.com/frappe/erpnext/issues/59274)) ([#59279](https://github.com/frappe/erpnext/issues/59279)) ([3b9c740](3b9c74024a))
* **stock:** use stored posting_datetime when reposting stock ledger entries ([#58998](https://github.com/frappe/erpnext/issues/58998)) ([c7893b8](c7893b8444))
* **stock:** validate warehouse account belongs to selected company ([#59191](https://github.com/frappe/erpnext/issues/59191)) ([5b2a0e7](5b2a0e73c3))
* update modified for last purchase rate (backport [#59044](https://github.com/frappe/erpnext/issues/59044)) ([#59105](https://github.com/frappe/erpnext/issues/59105)) ([db2e9ef](db2e9efab4))
* validate bank reconciliation date ranges ([dcff5c3](dcff5c3149))
* validate coupon pricing rules and validity dates ([3fbf440](3fbf440c77))
* validate shipping rule account company ([e54bf6f](e54bf6fe43))
* write off stranded stock value only when the warehouse is empty ([#59219](https://github.com/frappe/erpnext/issues/59219)) ([7a27634](7a276344a3))

### Performance Improvements

* filter by company in get_returned_invoice_items ([4fbc279](4fbc2791b8))
* reduce memory consumption during reposting ([#59117](https://github.com/frappe/erpnext/issues/59117)) ([dc08520](dc08520197)), closes [#52152](https://github.com/frappe/erpnext/issues/52152)
* skip legacy batch ledger lookups when no legacy entry exists ([#59110](https://github.com/frappe/erpnext/issues/59110)) ([0130d28](0130d287f6))

erpnext/__init__.py

@@ -4,7 +4,7 @@ import inspect
 import frappe
 from frappe.utils.user import is_website_user
 
-__version__ = "15.119.0"
+__version__ = "15.121.4"
 
 
 def get_default_company(user=None):

erpnext/accounts/custom/address.py

@@ -49,6 +49,10 @@ class ERPNextAddress(Address):
 
 @frappe.whitelist()
 def get_shipping_address(company, address=None):
+	# `select`, not `read`: the roles that fill in these transactions hold no Company `read` row.
+	# doc= so the named company is evaluated and User Permissions apply.
+	frappe.has_permission("Company", ptype="select", doc=company, throw=True)
+
 	filters = [
 		["Dynamic Link", "link_doctype", "=", "Company"],
 		["Dynamic Link", "link_name", "=", company],
@@ -65,4 +69,6 @@ def get_shipping_address(company, address=None):
 	if address:
 		address_as_dict = address[0]
 		name, address_template = get_address_templates(address_as_dict)
-		return address_as_dict.get("name"), frappe.render_template(address_template, address_as_dict)
+		return address_as_dict.get("name"), frappe.render_template(
+			address_template, address_as_dict, restrict_globals=True
+		)

erpnext/accounts/dashboard_chart_source/account_balance_timeline/account_balance_timeline.py

@@ -25,6 +25,7 @@ def get(
 ):
 	if chart_name:
 		chart = frappe.get_doc("Dashboard Chart", chart_name)
+		chart.check_permission("read")
 	else:
 		chart = frappe._dict(frappe.parse_json(chart))
 	timespan = chart.timespan
@@ -53,6 +54,9 @@ def get(
 			)
 		)
 
+	# authorise the account itself, as get_balance_on() does; doc= brings User Permissions with it
+	frappe.has_permission("Account", doc=account, throw=True)
+
 	if not to_date:
 		to_date = nowdate()
 	if not from_date:

erpnext/accounts/doctype/account/account.json

@@ -191,7 +191,7 @@
  "idx": 1,
  "is_tree": 1,
  "links": [],
- "modified": "2024-08-19 15:19:11.095045",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Account",
@@ -244,6 +244,46 @@
    "role": "Accounts Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "search_fields": "account_number",

erpnext/accounts/doctype/account/account.py

@@ -502,12 +502,19 @@ class Account(NestedSet):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_parent_account(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		"""select name from tabAccount
-		where is_group = 1 and docstatus != 2 and company = {}
-		and {} like {} order by name limit {} offset {}""".format("%s", searchfield, "%s", "%s", "%s"),
-		(filters["company"], "%%%s%%" % txt, page_len, start),
-		as_list=1,
+	return frappe.get_list(
+		"Account",
+		filters=[
+			["is_group", "=", 1],
+			["docstatus", "!=", 2],
+			["company", "=", filters["company"]],
+			[searchfield, "like", f"%{txt}%"],
+		],
+		fields=["name"],
+		order_by="name",
+		limit_start=start,
+		limit_page_length=page_len,
+		as_list=True,
 	)
 
 

erpnext/accounts/doctype/account/chart_of_accounts/chart_of_accounts.py

@@ -120,6 +120,8 @@ def identify_is_group(child):
 def get_chart(chart_template, existing_company=None):
 	chart = {}
 	if existing_company:
+		frappe.has_permission("Company", doc=existing_company, throw=True)
+
 		return get_account_tree_from_existing_company(existing_company)
 
 	elif chart_template == "Standard":

erpnext/accounts/doctype/accounting_dimension/accounting_dimension.py

@@ -207,8 +207,11 @@ def delete_accounting_dimension(doc):
 		frappe.clear_cache(doctype=doctype)
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def disable_dimension(doc):
+	# toggle_disabling rewrites a Custom Field site-wide, so demand the write that configures dimensions
+	frappe.has_permission("Accounting Dimension", "write", throw=True)
+
 	if frappe.flags.in_test:
 		toggle_disabling(doc=doc)
 	else:

erpnext/accounts/doctype/accounts_settings/accounts_settings.json

@@ -89,13 +89,14 @@
   "enable_fuzzy_matching",
   "reports_tab",
   "remarks_section",
-  "general_ledger_remarks_length",
+  "disable_include_dimensions",
   "column_break_lvjk",
-  "receivable_payable_remarks_length",
+  "general_ledger_remarks_length",
   "accounts_receivable_payable_tuning_section",
   "receivable_payable_fetch_method",
   "default_ageing_range",
   "column_break_ntmi",
+  "receivable_payable_remarks_length",
   "legacy_section",
   "ignore_is_opening_check_for_reporting",
   "payment_request_settings",
@@ -222,7 +223,8 @@
    "description": "The percentage you are allowed to bill more against the amount ordered. For example, if the order value is $100 for an item and tolerance is set as 10%, then you are allowed to bill up to $110 ",
    "fieldname": "over_billing_allowance",
    "fieldtype": "Currency",
-   "label": "Over Billing Allowance (%)"
+   "label": "Over Billing Allowance (%)",
+   "non_negative": 1
   },
   {
    "default": "1",
@@ -483,7 +485,7 @@
   {
    "fieldname": "remarks_section",
    "fieldtype": "Section Break",
-   "label": "Remarks Column Length"
+   "label": "General Ledger Report"
   },
   {
    "default": "0",
@@ -566,7 +568,7 @@
   {
    "fieldname": "accounts_receivable_payable_tuning_section",
    "fieldtype": "Section Break",
-   "label": "Accounts Receivable / Payable Tuning"
+   "label": "Accounts Receivable / Payable Report"
   },
   {
    "fieldname": "legacy_section",
@@ -665,6 +667,12 @@
    "fieldname": "default_ageing_range",
    "fieldtype": "Data",
    "label": "Default Ageing Range"
+  },
+  {
+   "default": "0",
+   "fieldname": "disable_include_dimensions",
+   "fieldtype": "Check",
+   "label": "Disable \"Consider Accounting Dimension\" Filter"
   }
  ],
  "icon": "icon-cog",
@@ -672,7 +680,7 @@
  "index_web_pages_for_search": 1,
  "issingle": 1,
  "links": [],
- "modified": "2026-06-24 12:59:41.868865",
+ "modified": "2026-09-04 10:08:30.115003",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Accounts Settings",

erpnext/accounts/doctype/accounts_settings/accounts_settings.py

@@ -44,6 +44,7 @@ class AccountsSettings(Document):
 		default_ageing_range: DF.Data | None
 		delete_linked_ledger_entries: DF.Check
 		determine_address_tax_category_from: DF.Literal["Billing Address", "Shipping Address"]
+		disable_include_dimensions: DF.Check
 		enable_common_party_accounting: DF.Check
 		enable_fuzzy_matching: DF.Check
 		enable_immutable_ledger: DF.Check

erpnext/accounts/doctype/advance_taxes_and_charges/advance_taxes_and_charges.json

@@ -94,11 +94,11 @@
    "fieldtype": "Column Break"
   },
   {
-    "allow_on_submit": 1,
-    "fieldname": "project",
-    "fieldtype": "Link",
-    "label": "Project",
-    "options": "Project"
+   "allow_on_submit": 1,
+   "fieldname": "project",
+   "fieldtype": "Link",
+   "label": "Project",
+   "options": "Project"
   },
   {
    "fieldname": "section_break_8",
@@ -187,12 +187,14 @@
  "index_web_pages_for_search": 1,
  "istable": 1,
  "links": [],
- "modified": "2021-11-25 11:10:10.945027",
+ "modified": "2026-05-01 00:38:53.368737",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Advance Taxes and Charges",
  "owner": "Administrator",
  "permissions": [],
+ "row_format": "Dynamic",
  "sort_field": "modified",
- "sort_order": "ASC"
-}
+ "sort_order": "ASC",
+ "states": []
+}

erpnext/accounts/doctype/advance_taxes_and_charges/advance_taxes_and_charges.py

@@ -30,6 +30,7 @@ class AdvanceTaxesandCharges(Document):
 		parent: DF.Data
 		parentfield: DF.Data
 		parenttype: DF.Data
+		project: DF.Link | None
 		rate: DF.Float
 		row_id: DF.Data | None
 		tax_amount: DF.Currency

erpnext/accounts/doctype/bank/bank.json

@@ -101,7 +101,7 @@
   }
  ],
  "links": [],
- "modified": "2020-07-17 14:00:13.105433",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Bank",
@@ -118,6 +118,14 @@
    "role": "System Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Accounts Manager",
+   "select": 1
+  },
+  {
+   "role": "Accounts User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/bank_account/bank_account.json

@@ -254,7 +254,7 @@
    "link_fieldname": "default_bank_account"
   }
  ],
- "modified": "2026-01-20 00:46:16.633364",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Bank Account",
@@ -284,6 +284,22 @@
    "role": "Accounts User",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/bank_guarantee/bank_guarantee.py

@@ -60,6 +60,9 @@ def get_voucher_details(bank_guarantee_type: str, reference_name: str):
 	if not isinstance(reference_name, str):
 		raise TypeError("reference_name must be a string")
 
+	# the form is the boundary, not the referenced order: an order guard would break one of the two roles
+	frappe.has_permission("Bank Guarantee", throw=True)
+
 	fields_to_fetch = ["grand_total"]
 
 	if bank_guarantee_type == "Receiving":

erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.js

@@ -68,6 +68,7 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 				frappe.msgprint(__("Please select Bank Account"));
 				return;
 			}
+			frm.events.validate_dates(frm);
 			frappe.call({
 				method: "erpnext.accounts.doctype.bank_reconciliation_tool.bank_reconciliation_tool.auto_reconcile_vouchers",
 				args: {
@@ -82,7 +83,7 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 		});
 
 		frm.add_custom_button(__("Get Unreconciled Entries"), function () {
-			frm.trigger("make_reconciliation_tool");
+			return frm.trigger("make_reconciliation_tool");
 		});
 		frm.change_custom_button_type(__("Get Unreconciled Entries"), null, "primary");
 	},
@@ -101,7 +102,24 @@ frappe.ui.form.on("Bank Reconciliation Tool", {
 		frm.trigger("get_account_opening_balance");
 	},
 
+	validate_dates(frm) {
+		const from_date = frm.doc.filter_by_reference_date
+			? frm.doc.from_reference_date
+			: frm.doc.bank_statement_from_date;
+		const to_date = frm.doc.filter_by_reference_date
+			? frm.doc.to_reference_date
+			: frm.doc.bank_statement_to_date;
+		if (from_date && to_date && from_date > to_date) {
+			frappe.throw(
+				frm.doc.filter_by_reference_date
+					? __("From Reference Date cannot be greater than To Reference Date")
+					: __("From Date cannot be greater than To Date")
+			);
+		}
+	},
+
 	make_reconciliation_tool(frm) {
+		frm.events.validate_dates(frm);
 		frm.get_field("reconciliation_tool_cards").$wrapper.empty();
 		if (frm.doc.company && frm.doc.bank_account && frm.doc.bank_statement_to_date) {
 			frm.trigger("get_cleared_balance").then(() => {

erpnext/accounts/doctype/bank_reconciliation_tool/bank_reconciliation_tool.py

@@ -3,13 +3,14 @@
 
 
 import json
+from datetime import date
 
 import frappe
 from frappe import _
 from frappe.model.document import Document
 from frappe.query_builder.custom import ConstantColumn
 from frappe.query_builder.functions import Sum
-from frappe.utils import cint, create_batch, flt
+from frappe.utils import cint, create_batch, flt, getdate
 
 from erpnext import get_default_cost_center
 from erpnext.accounts.doctype.bank_transaction.bank_transaction import get_total_allocated_amount
@@ -47,8 +48,12 @@ class BankReconciliationTool(Document):
 
 
 @frappe.whitelist()
-def get_bank_transactions(bank_account, from_date=None, to_date=None):
+def get_bank_transactions(
+	bank_account: str, from_date: str | date | None = None, to_date: str | date | None = None
+):
 	# returns bank transactions for a bank account
+	validate_date_range(from_date, to_date)
+
 	filters = []
 	filters.append(["bank_account", "=", bank_account])
 	filters.append(["docstatus", "=", 1])
@@ -372,13 +377,14 @@ def create_payment_entry_bts(
 
 @frappe.whitelist()
 def auto_reconcile_vouchers(
-	bank_account,
-	from_date=None,
-	to_date=None,
-	filter_by_reference_date=None,
-	from_reference_date=None,
-	to_reference_date=None,
+	bank_account: str,
+	from_date: str | date | None = None,
+	to_date: str | date | None = None,
+	filter_by_reference_date: bool | None = None,
+	from_reference_date: str | date | None = None,
+	to_reference_date: str | date | None = None,
 ):
+	validate_date_range(from_date, to_date, filter_by_reference_date, from_reference_date, to_reference_date)
 	bank_transactions = get_bank_transactions(bank_account)
 
 	if len(bank_transactions) > 10:
@@ -488,15 +494,16 @@ def reconcile_vouchers(bank_transaction_name, vouchers):
 
 @frappe.whitelist()
 def get_linked_payments(
-	bank_transaction_name,
-	document_types=None,
-	from_date=None,
-	to_date=None,
-	filter_by_reference_date=None,
-	from_reference_date=None,
-	to_reference_date=None,
+	bank_transaction_name: str,
+	document_types: str | list[str] | None = None,
+	from_date: str | date | None = None,
+	to_date: str | date | None = None,
+	filter_by_reference_date: bool | None = None,
+	from_reference_date: str | date | None = None,
+	to_reference_date: str | date | None = None,
 ):
 	# get all matching payments for a bank transaction
+	validate_date_range(from_date, to_date, filter_by_reference_date, from_reference_date, to_reference_date)
 	transaction = frappe.get_doc("Bank Transaction", bank_transaction_name)
 	bank_account = frappe.db.get_values(
 		"Bank Account", transaction.bank_account, ["account", "company"], as_dict=True
@@ -516,6 +523,23 @@ def get_linked_payments(
 	return subtract_allocations(gl_account, matching)
 
 
+def validate_date_range(
+	from_date,
+	to_date,
+	filter_by_reference_date=False,
+	from_reference_date=None,
+	to_reference_date=None,
+):
+	if cint(filter_by_reference_date):
+		from_date, to_date = from_reference_date, to_reference_date
+		message = _("From Reference Date cannot be greater than To Reference Date")
+	else:
+		message = _("From Date cannot be greater than To Date")
+
+	if from_date and to_date and getdate(from_date) > getdate(to_date):
+		frappe.throw(message)
+
+
 def subtract_allocations(gl_account, vouchers):
 	"Look up & subtract any existing Bank Transaction allocations"
 	copied = []

erpnext/accounts/doctype/bank_reconciliation_tool/test_bank_reconciliation_tool.py

@@ -10,6 +10,7 @@ from frappe.utils import add_days, today
 from erpnext.accounts.doctype.bank_reconciliation_tool.bank_reconciliation_tool import (
 	auto_reconcile_vouchers,
 	get_bank_transactions,
+	get_linked_payments,
 )
 from erpnext.accounts.doctype.payment_entry.test_payment_entry import create_payment_entry
 from erpnext.accounts.test.accounts_mixin import AccountsTestMixin
@@ -98,3 +99,42 @@ class TestBankReconciliationTool(AccountsTestMixin, FrappeTestCase):
 		# assert API output post reconciliation
 		transactions = get_bank_transactions(self.bank_account, from_date, to_date)
 		self.assertEqual(len(transactions), 0)
+
+	def test_rejects_reversed_date_ranges(self):
+		from_date, to_date = today(), add_days(today(), -1)
+		with self.assertRaisesRegex(frappe.ValidationError, "From Date cannot be greater than To Date"):
+			get_bank_transactions(self.bank_account, from_date, to_date)
+
+		with self.assertRaisesRegex(
+			frappe.ValidationError, "From Reference Date cannot be greater than To Reference Date"
+		):
+			auto_reconcile_vouchers(
+				self.bank_account,
+				filter_by_reference_date=True,
+				from_reference_date=from_date,
+				to_reference_date=to_date,
+			)
+
+		transaction = (
+			frappe.get_doc(
+				{
+					"doctype": "Bank Transaction",
+					"date": today(),
+					"deposit": 100,
+					"bank_account": self.bank_account,
+					"currency": "INR",
+				}
+			)
+			.insert()
+			.submit()
+		)
+		with self.assertRaisesRegex(
+			frappe.ValidationError, "From Reference Date cannot be greater than To Reference Date"
+		):
+			get_linked_payments(
+				transaction.name,
+				["payment_entry"],
+				filter_by_reference_date=True,
+				from_reference_date=from_date,
+				to_reference_date=to_date,
+			)

erpnext/accounts/doctype/bank_statement_import/bank_statement_import.py

@@ -105,25 +105,30 @@ class BankStatementImport(DataImport):
 
 @frappe.whitelist()
 def get_preview_from_template(data_import, import_file=None, google_sheets_url=None):
-	return frappe.get_doc("Bank Statement Import", data_import).get_preview_from_template(
-		import_file, google_sheets_url
-	)
+	bsi = frappe.get_doc("Bank Statement Import", data_import)
+	bsi.check_permission()
+	return bsi.get_preview_from_template(import_file, google_sheets_url)
 
 
 @frappe.whitelist()
 def form_start_import(data_import):
-	return frappe.get_doc("Bank Statement Import", data_import).start_import()
+	bsi = frappe.get_doc("Bank Statement Import", data_import)
+	bsi.check_permission("write")
+	return bsi.start_import()
 
 
 @frappe.whitelist()
 def download_errored_template(data_import_name):
 	data_import = frappe.get_doc("Bank Statement Import", data_import_name)
+	data_import.check_permission()
 	data_import.export_errored_rows()
 
 
 @frappe.whitelist()
 def download_import_log(data_import_name):
-	return frappe.get_doc("Bank Statement Import", data_import_name).download_import_log()
+	bsi = frappe.get_doc("Bank Statement Import", data_import_name)
+	bsi.check_permission()
+	return bsi.download_import_log()
 
 
 def parse_data_from_template(raw_data):
@@ -252,6 +257,7 @@ def get_import_status(docname):
 	import_status = {}
 
 	data_import = frappe.get_doc("Bank Statement Import", docname)
+	data_import.check_permission()
 	import_status["status"] = data_import.status
 
 	logs = frappe.get_all(
@@ -290,6 +296,10 @@ def get_import_logs(docname: str):
 
 @frappe.whitelist()
 def upload_bank_statement(**args):
+	# `create`: the sole caller is the Bank Reconciliation Tool's upload button, which routes
+	# straight into a new Bank Statement Import form.
+	frappe.has_permission("Bank Statement Import", "create", throw=True)
+
 	args = frappe._dict(args)
 	bsi = frappe.new_doc("Bank Statement Import")
 

erpnext/accounts/doctype/bank_transaction/bank_transaction_upload.py

@@ -11,6 +11,9 @@ from frappe.utils.dateutils import parse_date
 
 @frappe.whitelist()
 def upload_bank_statement():
+	# parsing a statement is the first step of creating Bank Transactions from it
+	frappe.has_permission("Bank Transaction", "create", throw=True)
+
 	if getattr(frappe, "uploaded_file", None):
 		with open(frappe.uploaded_file, "rb") as upfile:
 			fcontent = upfile.read()
@@ -36,6 +39,11 @@ def upload_bank_statement():
 
 @frappe.whitelist()
 def create_bank_entries(columns, data, bank_account):
+	# insert()/submit() enforce this per document, but only after the row loop has written an
+	# Error Log for every rejected row -- so check once up front.
+	frappe.has_permission("Bank Transaction", "create", throw=True)
+	frappe.has_permission("Bank Account", doc=bank_account, throw=True)
+
 	header_map = get_header_mapping(columns, bank_account)
 
 	success = 0

erpnext/accounts/doctype/budget/budget.py

@@ -98,13 +98,13 @@ class Budget(Document):
 					frappe.throw(_("Budget cannot be assigned against Group Account {0}").format(d.account))
 				elif account_details.company != self.company:
 					frappe.throw(
-						_("Account {0} does not belongs to company {1}").format(d.account, self.company)
+						_("Account {0} does not belong to company {1}").format(d.account, self.company)
 					)
 				elif account_details.report_type != "Profit and Loss":
 					frappe.throw(
 						_(
 							"Budget cannot be assigned against {0}, as its Root Type is not of Income or Expense"
-						).format(self.account)
+						).format(d.account)
 					)
 
 				if d.account in account_list:

erpnext/accounts/doctype/budget/test_budget.py

@@ -357,6 +357,16 @@ class TestBudget(unittest.TestCase):
 
 		self.assertRaises(BudgetError, jv.submit)
 
+	def test_budget_against_balance_sheet_account(self):
+		budget = frappe.new_doc("Budget")
+		budget.budget_against = "Cost Center"
+		budget.cost_center = "_Test Cost Center - _TC"
+		budget.company = "_Test Company"
+		budget.fiscal_year = get_fiscal_year(nowdate())[0]
+		budget.append("accounts", {"account": "_Test Bank - _TC", "budget_amount": 200000})
+
+		self.assertRaisesRegex(frappe.ValidationError, "_Test Bank - _TC", budget.insert)
+
 
 def set_total_expense_zero(posting_date, budget_against_field=None, budget_against_CC=None):
 	if budget_against_field == "project":

erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.js

@@ -110,18 +110,6 @@ frappe.ui.form.on("Chart of Accounts Importer", {
 				args: {
 					company: frm.doc.company,
 				},
-				callback: function (r) {
-					if (r.message === false) {
-						frm.set_value("company", "");
-						frappe.throw(
-							__(
-								"Transactions against the Company already exist! Chart of Accounts can only be imported for a Company with no transactions."
-							)
-						);
-					} else {
-						frm.trigger("refresh");
-					}
-				},
 			});
 		}
 	},

erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py

@@ -8,6 +8,7 @@ from functools import reduce
 
 import frappe
 from frappe import _
+from frappe.core.doctype.file.utils import find_file_by_url
 from frappe.desk.form.linked_with import get_linked_fields
 from frappe.model.document import Document
 from frappe.utils import cint, cstr
@@ -58,6 +59,8 @@ def validate_columns(data):
 
 @frappe.whitelist()
 def validate_company(company):
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
+
 	parent_company, allow_account_creation_against_child_company = frappe.get_cached_value(
 		"Company", company, ["parent_company", "allow_account_creation_against_child_company"]
 	)
@@ -70,22 +73,37 @@ def validate_company(company):
 		frappe.throw(msg, title=_("Wrong Company"))
 
 	if frappe.db.get_all("GL Entry", {"company": company}, "name", limit=1):
-		return False
+		frappe.throw(
+			_(
+				"Transactions against the Company already exist! Chart of Accounts can only be imported for a Company with no transactions."
+			)
+		)
+
+	validate_user_perms(company)
 
 
 @frappe.whitelist()
 def import_coa(file_name, company):
+	frappe.only_for("Accounts Manager")
+
 	# delete existing data for accounts
-	unset_existing_data(company)
+	frappe.has_permission("Company", "write", company, throw=True)
 
 	# create accounts
 	file_doc, extension = get_file(file_name)
+	validate_accounts(file_doc, extension)
 
 	if extension == "csv":
 		data = generate_data_from_csv(file_doc)
 	else:
 		data = generate_data_from_excel(file_doc, extension)
 
+	validate_columns(data)
+
+	validate_company(company)
+
+	unset_existing_data(company)
+
 	frappe.local.flags.ignore_root_company_validation = True
 	forest = build_forest(data)
 	create_charts(company, custom_chart=forest, from_coa_importer=True)
@@ -95,7 +113,11 @@ def import_coa(file_name, company):
 
 
 def get_file(file_name):
-	file_doc = frappe.get_doc("File", {"file_url": file_name})
+	# look the file up through find_file_by_url, which returns it only when the caller may download it
+	file_doc = find_file_by_url(file_name)
+	if not file_doc:
+		raise frappe.PermissionError
+
 	parts = file_doc.get_extension()
 	extension = parts[1]
 	extension = extension.lstrip(".")
@@ -161,6 +183,7 @@ def generate_data_from_excel(file_doc, extension, as_dict=False):
 @frappe.whitelist()
 def get_coa(doctype, parent, is_root=False, file_name=None, for_validate=0):
 	"""called by tree view (to fetch node's children)"""
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
 
 	file_doc, extension = get_file(file_name)
 	parent = None if parent == _("All Accounts") else parent
@@ -309,6 +332,8 @@ def build_response_as_excel(writer):
 
 @frappe.whitelist()
 def download_template(file_type, template_type, company):
+	frappe.has_permission("Chart of Accounts Importer", throw=True)
+
 	writer = get_template(template_type, company)
 
 	if file_type == "CSV":
@@ -452,6 +477,7 @@ def unset_existing_data(company):
 	fieldnames = get_linked_fields("Account").get("Company", {}).get("fieldname", [])
 	linked = [{"fieldname": name} for name in fieldnames]
 	update_values = {d.get("fieldname"): "" for d in linked}
+
 	frappe.db.set_value("Company", company, update_values, update_values)
 
 	# remove accounts data from various doctypes
@@ -467,6 +493,19 @@ def unset_existing_data(company):
 		frappe.qb.from_(dt).where(dt.company == company).delete().run()
 
 
+def validate_user_perms(company):
+	# User Permission Check for Account Deletion
+	company_accounts = frappe.get_query("Account", filters={"company": company}).run(as_dict=1)
+
+	for d in company_accounts:
+		if not frappe.get_cached_doc("Account", d.name).has_permission():
+			frappe.throw(
+				_(
+					"Accounts cannot be removed, as user doesn't have access to all the accounts of {0}."
+				).format(frappe.bold(company))
+			)
+
+
 def set_default_accounts(company):
 	from erpnext.setup.doctype.company.company import install_country_fixtures
 

erpnext/accounts/doctype/cost_center/cost_center.json

@@ -125,7 +125,7 @@
  "idx": 1,
  "is_tree": 1,
  "links": [],
- "modified": "2024-04-24 10:55:54.083042",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Cost Center",
@@ -172,6 +172,54 @@
    "role": "Employee",
    "select": 1,
    "share": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing User",
+   "select": 1
+  },
+  {
+   "role": "Projects Manager",
+   "select": 1
+  },
+  {
+   "role": "Projects User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "search_fields": "parent_cost_center, is_group",

erpnext/accounts/doctype/coupon_code/coupon_code.js

@@ -5,7 +5,10 @@ frappe.ui.form.on("Coupon Code", {
 	setup: function (frm) {
 		frm.set_query("pricing_rule", function () {
 			return {
-				filters: [["Pricing Rule", "coupon_code_based", "=", "1"]],
+				filters: {
+					coupon_code_based: 1,
+					disable: 0,
+				},
 			};
 		});
 	},

erpnext/accounts/doctype/coupon_code/coupon_code.json

@@ -115,7 +115,7 @@
    "read_only": 1
   }
  ],
- "modified": "2019-10-19 14:48:14.602481",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Coupon Code",
@@ -168,6 +168,14 @@
    "role": "Website Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
   }
  ],
  "sort_field": "modified",

erpnext/accounts/doctype/coupon_code/coupon_code.py

@@ -41,7 +41,23 @@ class CouponCode(Document):
 				self.coupon_code = frappe.generate_hash()[:10].upper()
 
 	def validate(self):
+		self.validate_from_to_dates("valid_from", "valid_upto")
+		self.validate_pricing_rule()
+
 		if self.coupon_type == "Gift Card":
 			self.maximum_use = 1
 			if not self.customer:
 				frappe.throw(_("Please select the customer."))
+
+	def validate_pricing_rule(self):
+		if not self.pricing_rule or self.get("from_external_ecomm_platform"):
+			return
+
+		# Allow existing coupons to be updated after their pricing rule is disabled.
+		if not (
+			self.has_value_changed("pricing_rule") or self.has_value_changed("from_external_ecomm_platform")
+		):
+			return
+
+		if frappe.db.get_value("Pricing Rule", self.pricing_rule, "disable"):
+			frappe.throw(_("Pricing Rule {0} is disabled").format(frappe.bold(self.pricing_rule)))

erpnext/accounts/doctype/coupon_code/test_coupon_code.py

@@ -115,8 +115,46 @@ class TestCouponCode(unittest.TestCase):
 		test_create_test_data()
 
 	def tearDown(self):
+		frappe.db.rollback()
 		frappe.set_user("Administrator")
 
+	def test_disabled_pricing_rule_validation(self):
+		coupon = frappe.get_doc("Coupon Code", "SAVE30")
+		rule = frappe.get_doc("Pricing Rule", coupon.pricing_rule)
+		rule.disable = 1
+		rule.save()
+
+		with self.subTest("new coupon cannot select a disabled rule"):
+			new_coupon = frappe.copy_doc(coupon)
+			new_coupon.coupon_name = "Festival Savings"
+			new_coupon.coupon_code = "FESTSAVE"
+			with self.assertRaisesRegex(frappe.ValidationError, "is disabled"):
+				new_coupon.insert()
+
+		with self.subTest("existing coupon can retain a disabled rule"):
+			coupon.description = "Offer paused"
+			coupon.save()
+			coupon.reload()
+			self.assertEqual(coupon.description, "Offer paused")
+			self.assertEqual(coupon.pricing_rule, rule.name)
+
+		with self.subTest("existing coupon cannot switch to a disabled rule"):
+			disabled_rule = frappe.copy_doc(rule)
+			disabled_rule.insert()
+			coupon.reload()
+			coupon.pricing_rule = disabled_rule.name
+			with self.assertRaisesRegex(frappe.ValidationError, "is disabled"):
+				coupon.save()
+			coupon.reload()
+			self.assertEqual(coupon.pricing_rule, rule.name)
+
+	def test_cannot_save_coupon_with_reversed_validity_dates(self):
+		coupon = frappe.get_doc("Coupon Code", "SAVE30")
+		coupon.valid_from = "2026-09-17"
+		coupon.valid_upto = "2026-09-02"
+		with self.assertRaises(frappe.exceptions.InvalidDates):
+			coupon.save()
+
 	def test_sales_order_with_coupon_code(self):
 		frappe.db.set_value("Coupon Code", "SAVE30", "used", 0)
 

erpnext/accounts/doctype/dunning/dunning.js

@@ -234,8 +234,10 @@ frappe.ui.form.on("Dunning", {
 				dn: frm.doc.name,
 			},
 			callback: function (r) {
-				var doc = frappe.model.sync(r.message);
-				frappe.set_route("Form", doc[0].doctype, doc[0].name);
+				if (!r.exc) {
+					var doc = frappe.model.sync(r.message);
+					frappe.set_route("Form", doc[0].doctype, doc[0].name);
+				}
 			},
 		});
 	},

erpnext/accounts/doctype/dunning/dunning.py

@@ -17,7 +17,8 @@ import json
 import frappe
 from frappe import _
 from frappe.contacts.doctype.address.address import get_address_display
-from frappe.utils import getdate
+from frappe.query_builder.functions import Sum
+from frappe.utils import flt, getdate
 
 from erpnext.controllers.accounts_controller import AccountsController
 
@@ -140,6 +141,31 @@ class Dunning(AccountsController):
 			)
 			row.dunning_level = len(past_dunnings) + 1
 
+	def get_unpaid_base_dunning_amount(self):
+		"""Interest and dunning fee that is still to be collected, in company currency."""
+		if not self.base_dunning_amount:
+			return 0.0
+
+		return flt(
+			flt(self.base_dunning_amount) - get_paid_dunning_amount(self.name),
+			self.precision("base_dunning_amount"),
+		)
+
+	def get_unpaid_dunning_amount(self):
+		"""Interest and dunning fee that is still to be collected, in the dunning currency."""
+		return flt(
+			self.get_unpaid_base_dunning_amount() / (flt(self.conversion_rate) or 1),
+			self.precision("dunning_amount"),
+		)
+
+	def get_unpaid_overdue_payments(self):
+		"""Overdue payments with their outstanding as of now, not as of dunning creation."""
+		return [
+			(row, outstanding)
+			for row in self.overdue_payments
+			if (outstanding := get_current_outstanding(row)) > 0
+		]
+
 	def on_cancel(self):
 		super().on_cancel()
 		self.ignore_linked_doctypes = [
@@ -154,6 +180,7 @@ class Dunning(AccountsController):
 			"Unreconcile Payment Entries",
 			"Payment Ledger Entry",
 			"Serial and Batch Bundle",
+			"Payment Entry",
 		]
 
 	@frappe.whitelist()
@@ -252,11 +279,73 @@ def update_linked_dunnings(doc, previous_outstanding_amount):
 			if has_outstanding:
 				break
 
-		new_status = "Resolved" if not has_outstanding else "Unresolved"
+		set_dunning_status(dunning, has_outstanding, respect_manual_resolution=True)
 
-		if dunning.status != new_status:
-			dunning.status = new_status
-			dunning.save()
+
+def update_dunnings_linked_to_payment(payment_entry):
+	"""Refresh dunnings whose interest and fee are settled by this payment."""
+	dunnings = {row.dunning for row in payment_entry.get("deductions") if row.dunning}
+
+	for name in dunnings:
+		dunning = frappe.get_doc("Dunning", name)
+		if dunning.docstatus != 1:
+			continue
+
+		set_dunning_status(dunning, bool(dunning.get_unpaid_overdue_payments()))
+
+
+def set_dunning_status(dunning, has_outstanding_payments: bool, respect_manual_resolution: bool = False):
+	"""A dunning is only resolved once the invoiced sum *and* its interest and fee are paid."""
+	has_unpaid_dunning_amount = dunning.get_unpaid_dunning_amount() > 0
+	new_status = "Unresolved" if has_outstanding_payments or has_unpaid_dunning_amount else "Resolved"
+
+	# resolving by hand waives the interest, only an invoice that is owed again reopens it
+	if respect_manual_resolution and dunning.status == "Resolved" and not has_outstanding_payments:
+		return
+
+	if dunning.status != new_status:
+		dunning.db_set("status", new_status, notify=True)
+
+
+def get_paid_dunning_amount(dunning: str) -> float:
+	"""Interest and fee collected for this dunning, in company currency."""
+	deduction = frappe.qb.DocType("Payment Entry Deduction")
+	payment_entry = frappe.qb.DocType("Payment Entry")
+
+	paid = (
+		frappe.qb.from_(deduction)
+		.join(payment_entry)
+		.on(payment_entry.name == deduction.parent)
+		.select(Sum(deduction.amount))
+		.where((deduction.dunning == dunning) & (payment_entry.docstatus == 1))
+	).run()
+
+	# the dunning amount is booked as a negative deduction, against the income account
+	return -flt(paid[0][0]) if paid else 0.0
+
+
+def get_current_outstanding(overdue_payment) -> float:
+	"""Outstanding of an overdue payment as of now, in the invoice's transaction currency."""
+	invoice = frappe.db.get_value(
+		"Sales Invoice",
+		overdue_payment.sales_invoice,
+		["outstanding_amount", "currency", "party_account_currency"],
+		as_dict=True,
+	)
+	schedule_outstanding = (
+		flt(frappe.db.get_value("Payment Schedule", overdue_payment.payment_schedule, "outstanding"))
+		if overdue_payment.payment_schedule
+		else flt(overdue_payment.outstanding)
+	)
+
+	if flt(invoice.outstanding_amount) <= 0 or schedule_outstanding <= 0:
+		return 0.0
+
+	outstanding = min(schedule_outstanding, flt(overdue_payment.outstanding))
+	if invoice.currency == invoice.party_account_currency:
+		outstanding = min(outstanding, flt(invoice.outstanding_amount))
+
+	return outstanding
 
 
 def get_linked_dunnings_as_per_state(sales_invoice, state):

erpnext/accounts/doctype/dunning/test_dunning.py

@@ -16,6 +16,7 @@ from erpnext.accounts.doctype.sales_invoice.sales_invoice import (
 	create_dunning as create_dunning_from_sales_invoice,
 )
 from erpnext.accounts.doctype.sales_invoice.test_sales_invoice import (
+	create_sales_invoice,
 	create_sales_invoice_against_cost_center,
 )
 
@@ -71,6 +72,123 @@ class TestDunning(FrappeTestCase):
 		dunning.reload()
 		self.assertEqual(dunning.status, "Resolved")
 
+	def test_dunning_not_resolved_by_payment_of_invoiced_sum_only(self):
+		"""
+		Regression for #58220: paying the invoice without the interest and fee must not
+		resolve the dunning, the interest is still owed and has to stay claimable.
+		"""
+		dunning = create_dunning(overdue_days=15, dunning_type_name="Second Notice - _TC")
+		dunning.submit()
+		sales_invoice = dunning.overdue_payments[0].sales_invoice
+
+		pe = get_payment_entry("Sales Invoice", sales_invoice)
+		pe.reference_no, pe.reference_date = "4", nowdate()
+		pe.insert()
+		pe.submit()
+
+		self.assertEqual(frappe.get_value("Sales Invoice", sales_invoice, "outstanding_amount"), 0)
+
+		dunning.reload()
+		self.assertEqual(dunning.status, "Unresolved")
+		self.assertEqual(round(dunning.get_unpaid_dunning_amount(), 2), 10.41)
+
+		# the interest and fee can still be collected on their own
+		pe = get_payment_entry("Dunning", dunning.name)
+		pe.reference_no, pe.reference_date = "5", nowdate()
+		self.assertEqual(pe.references, [])
+		self.assertEqual(round(pe.paid_amount, 2), 10.41)
+		pe.insert()
+		pe.submit()
+
+		dunning.reload()
+		self.assertEqual(dunning.status, "Resolved")
+		self.assertEqual(dunning.get_unpaid_dunning_amount(), 0)
+
+		# cancelling the interest payment makes the dunning claimable again
+		pe.cancel()
+		dunning.reload()
+		self.assertEqual(dunning.status, "Unresolved")
+		self.assertEqual(round(dunning.get_unpaid_dunning_amount(), 2), 10.41)
+
+	def test_dunning_can_be_cancelled_after_its_interest_was_paid(self):
+		"""
+		The payment collecting the interest links back to the dunning, which must not stand in
+		the way of cancelling it.
+		"""
+		dunning = create_dunning(overdue_days=15, dunning_type_name="Second Notice - _TC")
+		dunning.submit()
+
+		pe = get_payment_entry("Dunning", dunning.name)
+		pe.reference_no, pe.reference_date = "6", nowdate()
+		pe.insert()
+		pe.submit()
+
+		dunning.reload()
+		self.assertEqual(dunning.status, "Resolved")
+
+		dunning.cancel()
+		self.assertEqual(dunning.docstatus, 2)
+
+	def test_waived_interest_keeps_a_manually_resolved_dunning_resolved(self):
+		"""
+		Resolving a dunning by hand waives its interest, so a later payment of the invoice
+		must not reopen it.
+		"""
+		dunning = create_dunning(overdue_days=15, dunning_type_name="Second Notice - _TC")
+		dunning.submit()
+		sales_invoice = dunning.overdue_payments[0].sales_invoice
+
+		# what the "Resolve" button does
+		dunning.reload()
+		dunning.status = "Resolved"
+		dunning.save()
+
+		pe = get_payment_entry("Sales Invoice", sales_invoice)
+		pe.reference_no, pe.reference_date = "7", nowdate()
+		pe.insert()
+		pe.submit()
+
+		dunning.reload()
+		self.assertEqual(dunning.status, "Resolved")
+		self.assertEqual(round(dunning.get_unpaid_dunning_amount(), 2), 10.41)
+
+	def test_unpaid_dunning_amount_is_tracked_in_company_currency(self):
+		"""
+		The interest and fee are collected as a Payment Entry deduction, a company currency
+		field, so what is left to collect has to be measured in the same currency.
+		"""
+		si = create_sales_invoice(
+			posting_date=add_days(today(), -15),
+			customer="_Test Customer USD",
+			currency="USD",
+			conversion_rate=50,
+			rate=100,
+			debit_to="_Test Receivable USD - _TC",
+		)
+
+		dunning = create_dunning_from_sales_invoice(si.name)
+		dunning_type = frappe.get_doc("Dunning Type", "Second Notice - _TC")
+		dunning.dunning_type = dunning_type.name
+		dunning.rate_of_interest = dunning_type.rate_of_interest
+		dunning.dunning_fee = dunning_type.dunning_fee
+		dunning.income_account = dunning_type.income_account
+		dunning.cost_center = dunning_type.cost_center
+		dunning.save()
+
+		self.assertEqual(dunning.currency, "USD")
+		self.assertEqual(dunning.conversion_rate, 50)
+		self.assertEqual(round(dunning.dunning_amount, 2), 10.41)
+		self.assertEqual(round(dunning.base_dunning_amount, 2), 520.55)
+
+		# nothing collected yet, in either currency
+		self.assertEqual(round(dunning.get_unpaid_base_dunning_amount(), 2), 520.55)
+		self.assertEqual(round(dunning.get_unpaid_dunning_amount(), 2), 10.41)
+
+		# the deduction booking the interest is in company currency
+		dunning.submit()
+		pe = get_payment_entry("Dunning", dunning.name)
+		self.assertEqual(round(pe.deductions[0].amount, 2), -520.55)
+
 	def test_fetch_overdue_payments(self):
 		"""
 		Create SI with overdue payment. Check if overdue payment is fetched in Dunning.

erpnext/accounts/doctype/finance_book/finance_book.json

@@ -56,7 +56,7 @@
  "issingle": 0, 
  "istable": 0, 
  "max_attachments": 0, 
- "modified": "2018-05-09 14:55:01.394387", 
+ "modified": "2026-09-16 12:00:00.000000", 
  "modified_by": "Administrator", 
  "module": "Accounts", 
  "name": "Finance Book", 
@@ -119,6 +119,18 @@
    "share": 1, 
    "submit": 0, 
    "write": 0
+  }, 
+  {
+   "role": "HR Manager", 
+   "select": 1
+  }, 
+  {
+   "role": "Manufacturing Manager", 
+   "select": 1
+  }, 
+  {
+   "role": "Quality Manager", 
+   "select": 1
   }
  ], 
  "quick_entry": 1, 

erpnext/accounts/doctype/fiscal_year/fiscal_year.json

@@ -82,7 +82,7 @@
  "icon": "fa fa-calendar",
  "idx": 1,
  "links": [],
- "modified": "2024-05-27 17:29:55.560840",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Fiscal Year",
@@ -131,6 +131,10 @@
   {
    "read": 1,
    "role": "Auditor"
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
   }
  ],
  "show_name_in_global_search": 1,

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.js

@@ -136,6 +136,7 @@ frappe.ui.form.on("Invoice Discounting", {
 			],
 			primary_action: function () {
 				var data = d.get_values();
+				data.company = frm.doc.company;
 
 				frappe.call({
 					method: "erpnext.accounts.doctype.invoice_discounting.invoice_discounting.get_invoices",

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.json

@@ -168,7 +168,7 @@
   }
  ],
  "is_submittable": 1,
- "modified": "2019-05-30 19:08:21.199759",
+ "modified": "2026-09-09 17:04:59.512294",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Invoice Discounting",
@@ -185,7 +185,7 @@
    "print": 1,
    "read": 1,
    "report": 1,
-   "role": "System Manager",
+   "role": "Accounts Manager",
    "share": 1,
    "submit": 1,
    "write": 1
@@ -194,4 +194,4 @@
  "sort_field": "modified",
  "sort_order": "DESC",
  "track_changes": 1
-}
+}

erpnext/accounts/doctype/invoice_discounting/invoice_discounting.py

@@ -319,6 +319,13 @@ class InvoiceDiscounting(AccountsController):
 @frappe.whitelist()
 def get_invoices(filters):
 	filters = frappe._dict(json.loads(filters))
+
+	if not filters.get("company"):
+		frappe.throw(_("Please set company on the Document before requesting for invoices."))
+
+	frappe.has_permission("Company", doc=filters.get("company"), throw=True)
+	frappe.has_permission("Invoice Discounting", throw=True)
+
 	cond = []
 	if filters.customer:
 		cond.append("customer=%(customer)s")

erpnext/accounts/doctype/item_tax_template/item_tax_template.js

@@ -47,3 +47,12 @@ frappe.ui.form.on("Item Tax Template", {
 		});
 	},
 });
+
+frappe.ui.form.on("Item Tax Template Detail", {
+	not_applicable: function (frm, cdt, cdn) {
+		let row = locals[cdt][cdn];
+		if (row.not_applicable) {
+			frappe.model.set_value(cdt, cdn, "tax_rate", 0);
+		}
+	},
+});

erpnext/accounts/doctype/item_tax_template/item_tax_template.json

@@ -57,7 +57,7 @@
   }
  ],
  "links": [],
- "modified": "2023-07-09 18:11:23.105589",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Item Tax Template",
@@ -95,6 +95,54 @@
    "report": 1,
    "role": "Accounts User",
    "share": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Item Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock User",
+   "select": 1
   }
  ],
  "show_name_in_global_search": 1,

erpnext/accounts/doctype/item_tax_template/item_tax_template.py

@@ -27,8 +27,15 @@ class ItemTaxTemplate(Document):
 	# end: auto-generated types
 
 	def validate(self):
+		self.set_zero_rate_for_not_applicable_tax()
 		self.validate_tax_accounts()
 
+	def set_zero_rate_for_not_applicable_tax(self):
+		"""Ensure tax_rate is 0 for any row marked as not applicable."""
+		for row in self.get("taxes"):
+			if row.not_applicable:
+				row.tax_rate = 0
+
 	def autoname(self):
 		if self.company and self.title:
 			abbr = frappe.get_cached_value("Company", self.company, "abbr")

erpnext/accounts/doctype/item_tax_template/item_tax_template_dashboard.py

@@ -8,6 +8,6 @@ def get_data():
 			{"label": _("Pre Sales"), "items": ["Quotation", "Supplier Quotation"]},
 			{"label": _("Sales"), "items": ["Sales Invoice", "Sales Order", "Delivery Note"]},
 			{"label": _("Purchase"), "items": ["Purchase Invoice", "Purchase Order", "Purchase Receipt"]},
-			{"label": _("Stock"), "items": ["Item Groups", "Item"]},
+			{"label": _("Stock"), "items": ["Item Group", "Item"]},
 		],
 	}

erpnext/accounts/doctype/item_tax_template/test_item_tax_template.py

@@ -3,6 +3,142 @@
 
 import unittest
 
+import frappe
+from frappe.tests.utils import FrappeTestCase
+
+from erpnext.patches.v16_0.set_not_applicable_on_german_item_tax_templates import (
+	execute as backfill_not_applicable,
+)
+
 
 class TestItemTaxTemplate(unittest.TestCase):
 	pass
+
+
+class TestGermanNotApplicableBackfill(FrappeTestCase):
+	"""Run the `not_applicable` backfill patch against a seeded German company.
+
+	The company is created from the shipped German defaults, so the templates the
+	patch has to recognise are the ones a real site got. Each test resets the flag
+	to its pre-patch state (`not_applicable = 0`) and runs the patch.
+	"""
+
+	TITLES = ("19 %", "7 %", "0%")
+
+	@classmethod
+	def setUpClass(cls):
+		super().setUpClass()
+		cls.company = "_Test German Item Tax Templates"
+		if not frappe.db.exists("Company", cls.company):
+			frappe.get_doc(
+				{
+					"doctype": "Company",
+					"company_name": cls.company,
+					"abbr": "_TGITT",
+					"country": "Germany",
+					"default_currency": "EUR",
+					"create_chart_of_accounts_based_on": "Standard Template",
+					"chart_of_accounts": "Standard",
+				}
+			).insert()
+
+		cls.templates = {
+			title: frappe.db.get_value("Item Tax Template", {"company": cls.company, "title": title}, "name")
+			for title in cls.TITLES
+		}
+		assert all(cls.templates.values()), f"German defaults not seeded: {cls.templates}"
+
+	def setUp(self):
+		frappe.db.savepoint("before_backfill_test")
+		self.addCleanup(frappe.db.rollback, save_point="before_backfill_test")
+		self.seeded_flags = self.flagged_rows()
+		# every default template ships not-applicable rows, otherwise the patch
+		# would be tested against effectively empty data
+		for title in self.TITLES:
+			self.assertTrue(self.seeded_flags[title], f"no not-applicable rows seeded in {title}")
+
+	def flagged_rows(self, title=None) -> dict[str, set]:
+		"""Detail rows currently marked as not applicable, per template title."""
+		return {
+			t: {
+				d.name
+				for d in frappe.get_all(
+					"Item Tax Template Detail",
+					filters={"parent": name, "not_applicable": 1},
+					fields=["name"],
+				)
+			}
+			for t, name in self.templates.items()
+			if title in (None, t)
+		}
+
+	def clear_flags(self):
+		"""Restore the pre-patch state: zero rate, no flag."""
+		for name in self.templates.values():
+			frappe.db.set_value(
+				"Item Tax Template Detail",
+				{"parent": name},
+				"not_applicable",
+				0,
+				update_modified=False,
+			)
+		self.assertEqual(self.flagged_rows(), {t: set() for t in self.TITLES})
+
+	def add_zero_rate_row(self, title, account_name, account_number):
+		"""Add a user-defined zero-rate row, as a customised site would have."""
+		like_account = frappe.db.get_value(
+			"Account", {"company": self.company, "account_name": "Umsatzsteuer 19 %"}, "name"
+		)
+		account = frappe.get_doc(
+			{
+				"doctype": "Account",
+				"company": self.company,
+				"account_name": account_name,
+				"account_number": account_number,
+				"account_type": "Tax",
+				"parent_account": frappe.db.get_value("Account", like_account, "parent_account"),
+			}
+		).insert()
+
+		template = frappe.get_doc("Item Tax Template", self.templates[title])
+		template.append("taxes", {"tax_type": account.name, "tax_rate": 0})
+		template.save()
+
+	def test_backfills_unmodified_defaults(self):
+		self.clear_flags()
+		backfill_not_applicable()
+		self.assertEqual(self.flagged_rows(), self.seeded_flags)
+
+	def test_keeps_customised_template_untouched(self):
+		self.clear_flags()
+		self.add_zero_rate_row("19 %", "Sonstige Umsatzsteuer", "9998")
+		backfill_not_applicable()
+
+		self.assertEqual(self.flagged_rows("19 %"), {"19 %": set()})
+		self.assertEqual(self.flagged_rows("7 %"), {"7 %": self.seeded_flags["7 %"]})
+
+	def test_keeps_duplicate_account_name_untouched(self):
+		"""A numbered account can share `account_name` with a default one.
+
+		Its identifier collapses onto the default's, so only the row count tells
+		the customised template apart from an untouched one.
+		"""
+		self.clear_flags()
+		self.add_zero_rate_row("7 %", "Umsatzsteuer 19 %", "9999")
+		backfill_not_applicable()
+
+		self.assertEqual(self.flagged_rows("7 %"), {"7 %": set()})
+		self.assertEqual(self.flagged_rows("19 %"), {"19 %": self.seeded_flags["19 %"]})
+
+	def test_rerun_changes_nothing(self):
+		def snapshot():
+			return frappe.get_all(
+				"Item Tax Template Detail",
+				filters={"parent": ("in", tuple(self.templates.values()))},
+				fields=["name", "not_applicable", "tax_rate", "modified"],
+				order_by="name",
+			)
+
+		before = snapshot()
+		backfill_not_applicable()
+		self.assertEqual(snapshot(), before)

erpnext/accounts/doctype/item_tax_template_detail/item_tax_template_detail.json

@@ -6,7 +6,8 @@
  "engine": "InnoDB",
  "field_order": [
   "tax_type",
-  "tax_rate"
+  "tax_rate",
+  "not_applicable"
  ],
  "fields": [
   {
@@ -21,12 +22,21 @@
    "fieldname": "tax_rate",
    "fieldtype": "Float",
    "in_list_view": 1,
-   "label": "Tax Rate"
+   "label": "Tax Rate",
+   "read_only_depends_on": "eval:doc.not_applicable"
+  },
+  {
+   "default": "0",
+   "description": "Check if this tax is not applicable to items (distinct from 0% rate)",
+   "fieldname": "not_applicable",
+   "fieldtype": "Check",
+   "in_list_view": 1,
+   "label": "Not Applicable"
   }
  ],
  "istable": 1,
  "links": [],
- "modified": "2026-04-30 23:49:27.020639",
+ "modified": "2026-04-30 23:59:22.020639",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Item Tax Template Detail",

erpnext/accounts/doctype/item_tax_template_detail/item_tax_template_detail.py

@@ -14,6 +14,7 @@ class ItemTaxTemplateDetail(Document):
 	if TYPE_CHECKING:
 		from frappe.types import DF
 
+		not_applicable: DF.Check
 		parent: DF.Data
 		parentfield: DF.Data
 		parenttype: DF.Data

erpnext/accounts/doctype/journal_entry/journal_entry.js

@@ -65,7 +65,7 @@ frappe.ui.form.on("Journal Entry", {
 			);
 		}
 
-		if (frm.doc.docstatus == 1) {
+		if (frm.doc.docstatus == 1 && !frm.doc.reversal_of) {
 			frm.add_custom_button(
 				__("Reverse Journal Entry"),
 				function () {
@@ -421,8 +421,8 @@ cur_frm.cscript.update_totals = function (doc) {
 		tc += flt(accounts[i].credit, precision("credit", accounts[i]));
 	}
 	doc = locals[doc.doctype][doc.name];
-	doc.total_debit = td;
-	doc.total_credit = tc;
+	doc.total_debit = flt(td, precision("total_debit"));
+	doc.total_credit = flt(tc, precision("total_credit"));
 	doc.difference = flt(td - tc, precision("difference"));
 	refresh_many(["total_debit", "total_credit", "difference"]);
 };
@@ -516,7 +516,7 @@ $.extend(erpnext.journal_entry, {
 	lock_reversal_entry: function (frm) {
 		frm.fields
 			.filter((field) => field.has_input)
-			.filter((field) => field.df.fieldname != "posting_date")
+			.filter((field) => !["posting_date", "user_remark"].includes(field.df.fieldname))
 			.forEach((field) => frm.set_df_property(field.df.fieldname, "read_only", 1));
 		frm.set_df_property("accounts", "read_only", 1);
 	},

erpnext/accounts/doctype/journal_entry/journal_entry.py

@@ -7,7 +7,8 @@ import json
 import frappe
 from frappe import _, msgprint, scrub
 from frappe.core.doctype.submission_queue.submission_queue import queue_submission
-from frappe.utils import comma_and, cstr, flt, fmt_money, formatdate, get_link_to_form, nowdate
+from frappe.model.document import Document
+from frappe.utils import comma_and, cstr, flt, fmt_money, formatdate, get_link_to_form, getdate, nowdate
 
 import erpnext
 from erpnext.accounts.deferred_revenue import get_deferred_booking_accounts
@@ -154,7 +155,8 @@ class JournalEntry(AccountsController):
 
 		if self.docstatus == 0:
 			self.apply_tax_withholding()
-		if self.is_new() or not self.title:
+
+		if not self.title or (self.is_new() and self.amended_from):
 			self.title = self.get_title()
 
 	def validate_advance_accounts(self):
@@ -798,6 +800,23 @@ class JournalEntry(AccountsController):
 						)
 					)
 
+				if reference_type == "Purchase Invoice":
+					on_hold, release_date = frappe.db.get_value(
+						reference_type, reference_name, ["on_hold", "release_date"]
+					)
+
+					if not on_hold or (release_date and getdate(release_date) <= getdate(nowdate())):
+						continue
+
+					msg = (
+						_("{0} {1} is blocked and on hold until {2}.").format(
+							reference_type, reference_name, release_date
+						)
+						if release_date
+						else _("{0} {1} is blocked.").format(reference_type, reference_name)
+					)
+					frappe.throw(msg)
+
 	def set_against_account(self):
 		accounts_debited, accounts_credited = [], []
 		if self.voucher_type in ("Deferred Revenue", "Deferred Expense"):
@@ -842,12 +861,14 @@ class JournalEntry(AccountsController):
 			if d.debit and d.credit:
 				frappe.throw(_("You cannot credit and debit same account at the same time"))
 
-			self.total_debit = flt(self.total_debit) + flt(d.debit, d.precision("debit"))
-			self.total_credit = flt(self.total_credit) + flt(d.credit, d.precision("credit"))
+			self.total_debit = flt(
+				self.total_debit + flt(d.debit, d.precision("debit")), self.precision("total_debit")
+			)
+			self.total_credit = flt(
+				self.total_credit + flt(d.credit, d.precision("credit")), self.precision("total_credit")
+			)
 
-		self.difference = flt(self.total_debit, self.precision("total_debit")) - flt(
-			self.total_credit, self.precision("total_credit")
-		)
+		self.difference = flt(self.total_debit - self.total_credit, self.precision("difference"))
 
 	def validate_multi_currency(self):
 		alternate_currency = []
@@ -1458,6 +1479,10 @@ class JournalEntryTaxWithholding:
 def get_default_bank_cash_account(company, account_type=None, mode_of_payment=None, account=None):
 	from erpnext.accounts.doctype.sales_invoice.sales_invoice import get_bank_cash_account
 
+	# `select`, not `read`: also runs server-side from get_payment_entry, and Auditor/HR User/
+	# Desk User hold only the select row on Company. doc= for User Permissions.
+	frappe.has_permission("Company", ptype="select", doc=company, throw=True)
+
 	if mode_of_payment:
 		account = get_bank_cash_account(mode_of_payment, company).get("account")
 
@@ -1486,6 +1511,10 @@ def get_default_bank_cash_account(company, account_type=None, mode_of_payment=No
 					account = account_list[0].name
 
 	if account:
+		# `account` is caller-supplied; get_balance_on() checks it only on the branch that reads a
+		# balance, and `fetch_balance` is caller-supplied too.
+		frappe.has_permission("Account", doc=account, throw=True)
+
 		account_details = frappe.get_cached_value(
 			"Account", account, ["account_currency", "account_type"], as_dict=1
 		)
@@ -1507,6 +1536,7 @@ def get_payment_entry_against_order(
 	dt, dn, amount=None, debit_in_account_currency=None, journal_entry=False, bank_account=None
 ):
 	ref_doc = frappe.get_doc(dt, dn)
+	ref_doc.check_permission()
 
 	if flt(ref_doc.per_billed, 2) > 0:
 		frappe.throw(_("Can only make payment against unbilled {0}").format(dt))
@@ -1552,6 +1582,8 @@ def get_payment_entry_against_invoice(
 	dt, dn, amount=None, debit_in_account_currency=None, journal_entry=False, bank_account=None
 ):
 	ref_doc = frappe.get_doc(dt, dn)
+	ref_doc.check_permission()
+
 	if dt == "Sales Invoice":
 		party_type = "Customer"
 		party_account = get_party_account_based_on_invoice_discounting(dn) or ref_doc.debit_to
@@ -1587,6 +1619,8 @@ def get_payment_entry_against_invoice(
 
 
 def get_payment_entry(ref_doc, args):
+	frappe.has_permission("Journal Entry", ptype="create", throw=True)
+
 	cost_center = ref_doc.get("cost_center") or frappe.get_cached_value(
 		"Company", ref_doc.company, "cost_center"
 	)
@@ -1666,29 +1700,39 @@ def get_against_jv(doctype, txt, searchfield, start, page_len, filters):
 	if not frappe.db.has_column("Journal Entry", searchfield):
 		return []
 
-	return frappe.db.sql(
-		f"""
-		SELECT jv.name, jv.posting_date, jv.user_remark
-		FROM `tabJournal Entry` jv, `tabJournal Entry Account` jv_detail
-		WHERE jv_detail.parent = jv.name
-			AND jv_detail.account = %(account)s
-			AND IFNULL(jv_detail.party, '') = %(party)s
-			AND (
-				jv_detail.reference_type IS NULL
-				OR jv_detail.reference_type = ''
-			)
-			AND jv.docstatus = 1
-			AND jv.`{searchfield}` LIKE %(txt)s
-		ORDER BY jv.name DESC
-		LIMIT %(limit)s offset %(offset)s
-		""",
-		dict(
-			account=filters.get("account"),
-			party=cstr(filters.get("party")),
-			txt=f"%{txt}%",
-			offset=start,
-			limit=page_len,
-		),
+	account = filters.get("account")
+	party = filters.get("party")
+
+	# each names one value. A list would be read as a filter operator below and widen the search
+	# past what the caller named.
+	for value in (account, party):
+		if value and not isinstance(value, str):
+			frappe.throw(_("Invalid filter"), frappe.PermissionError)
+
+	# get_list applies the permission query conditions; the child-table filter resolves the check to `read`
+	je_filters = [
+		["docstatus", "=", 1],
+		[searchfield, "like", f"%{txt}%"],
+		["Journal Entry Account", "account", "=", account],
+		["Journal Entry Account", "reference_type", "is", "not set"],
+	]
+	je_filters.append(
+		["Journal Entry Account", "party", "=", party]
+		if party
+		else ["Journal Entry Account", "party", "is", "not set"]
+	)
+
+	return frappe.get_list(
+		"Journal Entry",
+		filters=je_filters,
+		fields=["name", "posting_date", "user_remark"],
+		order_by="name desc",
+		limit_start=start,
+		limit_page_length=page_len,
+		as_list=True,
+		# one row per entry, not per matching account row. group_by rather than distinct: frappe
+		# drops ORDER BY from a distinct query on postgres, which would lose the ordering above.
+		group_by="name",
 	)
 
 
@@ -1874,11 +1918,29 @@ def make_inter_company_journal_entry(name, voucher_type, company):
 
 
 @frappe.whitelist()
-def make_reverse_journal_entry(source_name, target_doc=None):
+def make_reverse_journal_entry(source_name: str, target_doc: str | dict | Document | None = None) -> Document:
+	# `get_mapped_doc` checks this as well, but the guard below discloses which entry
+	# reverses which, so read access has to be settled before it runs
+	if not frappe.has_permission("Journal Entry", doc=source_name):
+		frappe.throw(_("Not permitted"), frappe.PermissionError)
+
+	reversal_of = frappe.db.get_value("Journal Entry", source_name, "reversal_of")
+	if reversal_of:
+		frappe.throw(
+			_("{0} is already a Reverse Journal Entry of {1}. Cancel it instead of reversing it.").format(
+				get_link_to_form("Journal Entry", source_name),
+				get_link_to_form("Journal Entry", reversal_of),
+			)
+		)
+
 	from frappe.model.mapper import get_mapped_doc
 
 	def post_process(source, target):
 		target.reversal_of = source.name
+		target.naming_series = source.naming_series
+		if source.voucher_type == "Bank Entry":
+			target.cheque_no = source.cheque_no
+			target.cheque_date = source.cheque_date
 
 	doclist = get_mapped_doc(
 		"Journal Entry",

erpnext/accounts/doctype/journal_entry/test_journal_entry.py

@@ -6,7 +6,7 @@ import unittest
 
 import frappe
 from frappe.tests.utils import change_settings
-from frappe.utils import flt, nowdate
+from frappe.utils import add_days, flt, nowdate
 
 from erpnext.accounts.doctype.account.test_account import get_inventory_account
 from erpnext.accounts.doctype.journal_entry.journal_entry import StockAccountInvalidTransaction
@@ -249,6 +249,27 @@ class TestJournalEntry(unittest.TestCase):
 
 		self.check_gl_entries()
 
+	def test_disallow_reversal_of_a_reversal_journal_entry(self):
+		from erpnext.accounts.doctype.journal_entry.journal_entry import make_reverse_journal_entry
+
+		jv = make_journal_entry("_Test Bank - _TC", "Sales - _TC", 100, submit=True)
+
+		rjv = make_reverse_journal_entry(jv.name)
+		rjv.posting_date = nowdate()
+		rjv.submit()
+
+		self.assertRaisesRegex(
+			frappe.ValidationError,
+			"is already a Reverse Journal Entry",
+			make_reverse_journal_entry,
+			rjv.name,
+		)
+
+		# the guard must not disclose the reversal to a user who cannot read the entry
+		frappe.set_user("Guest")
+		self.addCleanup(frappe.set_user, "Administrator")
+		self.assertRaises(frappe.PermissionError, make_reverse_journal_entry, rjv.name)
+
 	def test_disallow_change_in_account_currency_for_a_party(self):
 		# create jv in USD
 		jv = make_journal_entry("_Test Bank USD - _TC", "_Test Receivable USD - _TC", 100, save=False)
@@ -389,6 +410,59 @@ class TestJournalEntry(unittest.TestCase):
 
 		self.check_gl_entries()
 
+	def make_jv_with_fractional_totals(self):
+		"""0.10 + 0.20 sums to 0.30000000000000004, the residue this guards against."""
+		jv = frappe.new_doc("Journal Entry")
+		jv.posting_date = nowdate()
+		jv.company = "_Test Company"
+		jv.voucher_type = "Journal Entry"
+		jv.remark = "test"
+		for amount in (0.10, 0.20):
+			jv.append(
+				"accounts",
+				{
+					"account": "_Test Cash - _TC",
+					"cost_center": "_Test Cost Center - _TC",
+					"debit_in_account_currency": amount,
+				},
+			)
+		jv.append(
+			"accounts",
+			{
+				"account": "_Test Bank - _TC",
+				"cost_center": "_Test Cost Center - _TC",
+				"credit_in_account_currency": 0.30,
+			},
+		)
+		jv.insert()
+		return jv
+
+	def test_totals_are_rounded_to_precision(self):
+		jv = self.make_jv_with_fractional_totals()
+		jv.submit()
+
+		stored = frappe.db.get_value(
+			"Journal Entry", jv.name, ["total_debit", "total_credit", "difference"], as_dict=True
+		)
+		self.assertEqual(jv.total_debit, flt(jv.total_debit, jv.precision("total_debit")))
+		self.assertEqual(jv.total_credit, flt(jv.total_credit, jv.precision("total_credit")))
+		self.assertEqual(jv.total_debit, stored.total_debit)
+		self.assertEqual(jv.total_credit, stored.total_credit)
+		self.assertEqual(jv.difference, stored.difference)
+
+	def test_update_after_submit_with_fractional_totals(self):
+		"""An unrounded total is stored rounded, so updating a submitted entry used to throw."""
+		jv = self.make_jv_with_fractional_totals()
+		jv.submit()
+
+		jv.pay_to_recd_from = "_Test Supplier"
+		jv.save()
+
+		self.assertEqual(jv.docstatus, 1)
+		self.assertEqual(
+			jv.pay_to_recd_from, frappe.db.get_value("Journal Entry", jv.name, "pay_to_recd_from")
+		)
+
 	def test_jv_account_and_party_balance_with_cost_centre(self):
 		from erpnext.accounts.doctype.cost_center.test_cost_center import create_cost_center
 		from erpnext.accounts.utils import get_balance_on
@@ -602,6 +676,69 @@ class TestJournalEntry(unittest.TestCase):
 		jv.save()
 		self.assertRaises(frappe.ValidationError, jv.submit)
 
+	def make_jv_against_purchase_invoice(self, invoice, amount=100):
+		jv = make_journal_entry("Creditors - _TC", "_Test Cash - _TC", amount, save=False)
+		jv.accounts[0].party_type = "Supplier"
+		jv.accounts[0].party = invoice.supplier
+		jv.accounts[0].reference_type = "Purchase Invoice"
+		jv.accounts[0].reference_name = invoice.name
+		return jv
+
+	def test_jv_against_purchase_invoice_respects_hold_state(self):
+		"""Payment can be booked against a Purchase Invoice only while it is not on hold."""
+		from erpnext.accounts.doctype.purchase_invoice.test_purchase_invoice import make_purchase_invoice
+
+		release_date = add_days(nowdate(), 10)
+
+		def never_held():
+			return make_purchase_invoice()
+
+		def held_until_a_future_date():
+			invoice = make_purchase_invoice()
+			invoice.block_invoice(hold_comment="Waiting for the goods", release_date=release_date)
+			return invoice
+
+		def held_without_a_release_date():
+			invoice = make_purchase_invoice()
+			invoice.block_invoice(hold_comment="Under dispute")
+			return invoice
+
+		def held_until_a_date_that_has_passed():
+			invoice = held_until_a_future_date()
+			frappe.db.set_value("Purchase Invoice", invoice.name, "release_date", add_days(nowdate(), -1))
+			return invoice
+
+		def unblocked_again():
+			invoice = held_until_a_future_date()
+			invoice.unblock_invoice()
+			return invoice
+
+		for build_invoice in (held_until_a_future_date, held_without_a_release_date):
+			with self.subTest(build_invoice.__name__):
+				jv = self.make_jv_against_purchase_invoice(build_invoice())
+				self.assertRaisesRegex(frappe.ValidationError, "is blocked", jv.insert)
+
+		for build_invoice in (never_held, held_until_a_date_that_has_passed, unblocked_again):
+			with self.subTest(build_invoice.__name__):
+				invoice = build_invoice()
+				jv = self.make_jv_against_purchase_invoice(invoice)
+				jv.insert()
+				self.assertEqual(jv.reference_types[invoice.name], "Purchase Invoice")
+
+	def test_jv_against_blocked_sales_invoice_reference_is_not_checked(self):
+		"""A Sales Invoice has no hold state, so the check must skip it rather than fail."""
+		from erpnext.accounts.doctype.sales_invoice.test_sales_invoice import create_sales_invoice
+
+		invoice = create_sales_invoice(rate=500)
+		jv = make_journal_entry("_Test Cash - _TC", "Debtors - _TC", 100, save=False)
+		jv.accounts[1].party_type = "Customer"
+		jv.accounts[1].party = "_Test Customer"
+		jv.accounts[1].reference_type = "Sales Invoice"
+		jv.accounts[1].reference_name = invoice.name
+		jv.insert()
+
+		self.assertEqual(jv.reference_types[invoice.name], "Sales Invoice")
+
 
 def make_journal_entry(
 	account1,

erpnext/accounts/doctype/ledger_merge/ledger_merge.py

@@ -56,7 +56,9 @@ class LedgerMerge(Document):
 
 @frappe.whitelist()
 def form_start_merge(docname):
-	return frappe.get_doc("Ledger Merge", docname).start_merge()
+	lm_doc = frappe.get_doc("Ledger Merge", docname)
+	lm_doc.check_permission("write")
+	return lm_doc.start_merge()
 
 
 def start_merge(docname):

erpnext/accounts/doctype/loyalty_program/loyalty_program.json

@@ -152,7 +152,7 @@
     "options": "Project"
   }
  ],
- "modified": "2019-05-26 09:11:46.120251",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Loyalty Program",
@@ -169,6 +169,14 @@
    "role": "System Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/loyalty_program/loyalty_program.py

@@ -86,6 +86,8 @@ def get_loyalty_program_details_with_points(
 	include_expired_entry=False,
 	current_transaction_amount=0,
 ):
+	frappe.has_permission("Customer", doc=customer, throw=True)
+
 	lp_details = get_loyalty_program_details(customer, loyalty_program, company=company, silent=silent)
 	loyalty_program = frappe.get_doc("Loyalty Program", loyalty_program)
 	lp_details.update(
@@ -116,6 +118,10 @@ def get_loyalty_program_details(
 	silent=False,
 	include_expired_entry=False,
 ):
+	# authorise the customer, not the programme: a Loyalty Program check is read-only to System
+	# Manager and would deny every role that fills in the two calling forms.
+	frappe.has_permission("Customer", doc=customer, throw=True)
+
 	lp_details = frappe._dict()
 
 	if not loyalty_program:
@@ -137,6 +143,13 @@ def get_loyalty_program_details(
 
 @frappe.whitelist()
 def get_redeemption_factor(loyalty_program=None, customer=None):
+	# both call sites send only `loyalty_program`, so the calling form is the boundary; the customer branch stays guarded
+	if not (frappe.has_permission("Sales Invoice") or frappe.has_permission("POS Invoice")):
+		frappe.throw(_("Not permitted"), frappe.PermissionError)
+
+	if customer:
+		frappe.has_permission("Customer", doc=customer, throw=True)
+
 	customer_loyalty_program = None
 	if not loyalty_program:
 		customer_loyalty_program = frappe.db.get_value("Customer", customer, "loyalty_program")

erpnext/accounts/doctype/mode_of_payment/mode_of_payment.json

@@ -48,7 +48,7 @@
  "idx": 1,
  "index_web_pages_for_search": 1,
  "links": [],
- "modified": "2020-09-18 17:57:23.835236",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Mode of Payment",
@@ -68,6 +68,30 @@
    "read": 1,
    "report": 1,
    "role": "Accounts User"
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/monthly_distribution/monthly_distribution.json

@@ -46,7 +46,7 @@
  "icon": "fa fa-bar-chart",
  "idx": 1,
  "links": [],
- "modified": "2024-01-30 13:57:55.802744",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Monthly Distribution",
@@ -69,6 +69,10 @@
    "read": 1,
    "report": 1,
    "role": "Accounts Manager"
+  },
+  {
+   "role": "Sales Master Manager",
+   "select": 1
   }
  ],
  "sort_field": "modified",

erpnext/accounts/doctype/opening_invoice_creation_tool/opening_invoice_creation_tool.py

@@ -282,6 +282,9 @@ def start_import(invoices):
 				invoice_number = d.invoice_number
 			doc = frappe.get_doc(d)
 			doc.flags.ignore_mandatory = True
+			# the outstanding amount is entered inclusive of tax, so taxes must not
+			# be added on top of it
+			doc.flags.dont_auto_add_taxes = True
 			doc.insert(set_name=invoice_number)
 			doc.submit()
 			frappe.db.commit()

erpnext/accounts/doctype/opening_invoice_creation_tool/test_opening_invoice_creation_tool.py

@@ -2,9 +2,10 @@
 # See license.txt
 
 import frappe
-from frappe.tests.utils import FrappeTestCase
+from frappe.tests.utils import FrappeTestCase, change_settings
 from frappe.utils import add_days, today
 
+from erpnext.accounts.doctype.account.test_account import create_account
 from erpnext.accounts.doctype.accounting_dimension.test_accounting_dimension import (
 	create_dimension,
 	disable_dimension,
@@ -12,6 +13,7 @@ from erpnext.accounts.doctype.accounting_dimension.test_accounting_dimension imp
 from erpnext.accounts.doctype.opening_invoice_creation_tool.opening_invoice_creation_tool import (
 	get_temporary_opening_account,
 )
+from erpnext.accounts.doctype.tax_rule.test_tax_rule import make_tax_rule
 from erpnext.projects.doctype.project.test_project import make_project
 
 test_dependencies = ["Customer", "Supplier", "Accounting Dimension"]
@@ -140,6 +142,55 @@ class TestOpeningInvoiceCreationTool(FrappeTestCase):
 		for invoice in invoices:
 			self.assertEqual(frappe.db.get_value("Sales Invoice", invoice, "department"), "Sales - _TOIC")
 
+	@change_settings(
+		"Accounts Settings",
+		{"add_taxes_from_taxes_and_charges_template": 1, "add_taxes_from_item_tax_template": 0},
+	)
+	def test_opening_invoice_creation_without_taxes(self):
+		company = "_Test Opening Invoice Company"
+		template = frappe.get_doc(
+			{
+				"doctype": "Sales Taxes and Charges Template",
+				"company": company,
+				"title": "_Test Opening Invoice Tax",
+				"taxes": [
+					{
+						"charge_type": "On Net Total",
+						"account_head": create_account(
+							account_name="_Test Opening Tax Account",
+							parent_account="Duties and Taxes - _TOIC",
+							account_type="Tax",
+							company=company,
+						),
+						"description": "Test taxes",
+						"rate": 9,
+					}
+				],
+			}
+		).insert()
+
+		# makes the template the default for the party, as it would be on a live site
+		make_tax_rule(tax_type="Sales", company=company, sales_tax_template=template.name, save=1)
+
+		tool = self.make_invoices(company=company, return_doc=True)
+		invoices = tool.make_invoices()
+		self.assertEqual(len(invoices), 2)
+
+		# outstanding amount is entered inclusive of tax, so taxes must not be added on top of it
+		for invoice in invoices:
+			si = frappe.get_doc("Sales Invoice", invoice)
+			self.assertFalse(si.taxes)
+			self.assertEqual(si.grand_total, 200)
+			self.assertEqual(si.outstanding_amount, 200)
+
+		# the same invoice created outside the tool keeps the default taxes,
+		# since adding them there is the user's decision
+		si = frappe.get_doc(tool.get_invoices()[0])
+		si.flags.ignore_mandatory = True
+		si.insert()
+		self.assertTrue(si.taxes)
+		self.assertEqual(si.grand_total, 218)
+
 	def test_opening_entry_project_linking(self):
 		doc = self.make_invoices(
 			company="_Test Opening Invoice Company", invoice_type="Sales", return_doc=True

erpnext/accounts/doctype/payment_entry/payment_entry.js

@@ -45,23 +45,27 @@ frappe.ui.form.on("Payment Entry", {
 	},
 
 	setup: function (frm) {
-		frm.set_query("paid_from", function () {
+		frm.set_query("paid_from", function (doc) {
 			frm.events.validate_company(frm);
 
 			var account_types = ["Pay", "Internal Transfer"].includes(frm.doc.payment_type)
 				? ["Bank", "Cash"]
 				: [frappe.boot.party_account_types[frm.doc.party_type]];
+			let filters = {
+				account_type: ["in", account_types],
+				is_group: 0,
+				company: doc.company,
+			};
 
 			if (frm.doc.party_type == "Shareholder") {
 				account_types.push("Equity");
 			}
+			if (doc.payment_type == "Internal Transfer" && doc.paid_to) {
+				filters.name = ["!=", doc.paid_to];
+			}
 
 			return {
-				filters: {
-					account_type: ["in", account_types],
-					is_group: 0,
-					company: frm.doc.company,
-				},
+				filters,
 			};
 		});
 
@@ -105,21 +109,25 @@ frappe.ui.form.on("Payment Entry", {
 			}
 		});
 
-		frm.set_query("paid_to", function () {
+		frm.set_query("paid_to", function (doc) {
 			frm.events.validate_company(frm);
 
 			var account_types = ["Receive", "Internal Transfer"].includes(frm.doc.payment_type)
 				? ["Bank", "Cash"]
 				: [frappe.boot.party_account_types[frm.doc.party_type]];
+			let filters = {
+				account_type: ["in", account_types],
+				is_group: 0,
+				company: doc.company,
+			};
 			if (frm.doc.party_type == "Shareholder") {
 				account_types.push("Equity");
 			}
+			if (doc.payment_type == "Internal Transfer" && doc.paid_from) {
+				filters.name = ["!=", doc.paid_from];
+			}
 			return {
-				filters: {
-					account_type: ["in", account_types],
-					is_group: 0,
-					company: frm.doc.company,
-				},
+				filters,
 			};
 		});
 

erpnext/accounts/doctype/payment_entry/payment_entry.py

@@ -3,6 +3,7 @@
 
 
 import json
+from datetime import date
 from functools import reduce
 
 import frappe
@@ -90,6 +91,7 @@ class PaymentEntry(AccountsController):
 		self.set_liability_account()
 		self.set_missing_ref_details(force=True)
 		self.validate_payment_type()
+		self.validate_internal_transfer_accounts()
 		self.validate_party_details()
 		self.set_exchange_rate()
 		self.validate_mandatory()
@@ -121,8 +123,14 @@ class PaymentEntry(AccountsController):
 		self.update_payment_schedule()
 		self.make_gl_entries()
 		self.update_outstanding_amounts()
+		self.update_linked_dunnings()
 		self.set_status()
 
+	def update_linked_dunnings(self):
+		from erpnext.accounts.doctype.dunning.dunning import update_dunnings_linked_to_payment
+
+		update_dunnings_linked_to_payment(self)
+
 	def validate_for_repost(self):
 		validate_docs_for_voucher_types(["Payment Entry"])
 		validate_docs_for_deferred_accounting([self.name], [])
@@ -224,6 +232,7 @@ class PaymentEntry(AccountsController):
 		self.update_payment_schedule(cancel=1)
 		self.make_gl_entries(cancel=1)
 		self.update_outstanding_amounts()
+		self.update_linked_dunnings()
 		self.delink_advance_entry_references()
 		self.set_status()
 
@@ -531,6 +540,10 @@ class PaymentEntry(AccountsController):
 		if self.payment_type not in ("Receive", "Pay", "Internal Transfer"):
 			frappe.throw(_("Payment Type must be one of Receive, Pay and Internal Transfer"))
 
+	def validate_internal_transfer_accounts(self):
+		if self.payment_type == "Internal Transfer" and self.paid_from and self.paid_from == self.paid_to:
+			frappe.throw(_("Paid From and Paid To accounts must be different for an Internal Transfer."))
+
 	def validate_party_details(self):
 		if self.party and not frappe.db.exists(self.party_type, self.party):
 			frappe.throw(_("{0} {1} does not exist").format(_(self.party_type), self.party))
@@ -2886,18 +2899,21 @@ def get_reference_details(
 
 @frappe.whitelist()
 def get_payment_entry(
-	dt,
-	dn,
-	party_amount=None,
-	bank_account=None,
-	bank_amount=None,
-	party_type=None,
-	payment_type=None,
-	reference_date=None,
-	ignore_permissions=False,
-	created_from_payment_request=False,
+	dt: str,
+	dn: str,
+	party_amount: int | float | None = None,
+	bank_account: str | None = None,
+	bank_amount: int | float | None = None,
+	party_type: str | None = None,
+	payment_type: str | None = None,
+	reference_date: str | date | None = None,
+	created_from_payment_request: bool | None = False,
 ):
+	frappe.has_permission("Payment Entry", ptype="create", throw=True)
+
 	doc = frappe.get_doc(dt, dn)
+	doc.check_permission()
+
 	over_billing_allowance = frappe.db.get_single_value("Accounts Settings", "over_billing_allowance")
 	if dt in ("Sales Order", "Purchase Order") and flt(doc.per_billed, 2) >= (100.0 + over_billing_allowance):
 		frappe.throw(_("Can only make payment against unbilled {0}").format(_(dt)))
@@ -2992,7 +3008,7 @@ def get_payment_entry(
 				pe.append("references", reference)
 		else:
 			if dt == "Dunning":
-				for overdue_payment in doc.overdue_payments:
+				for overdue_payment, outstanding in doc.get_unpaid_overdue_payments():
 					pe.append(
 						"references",
 						{
@@ -3000,21 +3016,23 @@ def get_payment_entry(
 							"reference_name": overdue_payment.sales_invoice,
 							"payment_term": overdue_payment.payment_term,
 							"due_date": overdue_payment.due_date,
-							"total_amount": overdue_payment.outstanding,
-							"outstanding_amount": overdue_payment.outstanding,
-							"allocated_amount": overdue_payment.outstanding,
+							"total_amount": outstanding,
+							"outstanding_amount": outstanding,
+							"allocated_amount": outstanding,
 						},
 					)
 
-				pe.append(
-					"deductions",
-					{
-						"account": doc.income_account,
-						"cost_center": doc.cost_center,
-						"amount": -1 * doc.dunning_amount,
-						"description": _("Interest and/or dunning fee"),
-					},
-				)
+				if (unpaid_dunning_amount := doc.get_unpaid_base_dunning_amount()) > 0:
+					pe.append(
+						"deductions",
+						{
+							"account": doc.income_account,
+							"cost_center": doc.cost_center,
+							"amount": -1 * unpaid_dunning_amount,
+							"description": _("Interest and/or dunning fee"),
+							"dunning": doc.name,
+						},
+					)
 			else:
 				pe.append(
 					"references",
@@ -3296,8 +3314,10 @@ def set_grand_total_and_outstanding_amount(party_amount, dt, party_account_curre
 			grand_total = doc.rounded_total or doc.grand_total
 		outstanding_amount = doc.outstanding_amount
 	elif dt == "Dunning":
-		grand_total = doc.grand_total
-		outstanding_amount = doc.grand_total
+		# only what is left to collect, the totals on the dunning are the ones it was raised with
+		grand_total = sum(outstanding for _row, outstanding in doc.get_unpaid_overdue_payments())
+		grand_total += doc.get_unpaid_dunning_amount()
+		outstanding_amount = grand_total
 	else:
 		if party_account_currency == doc.company_currency:
 			grand_total = flt(doc.get("base_rounded_total") or doc.get("base_grand_total"))

erpnext/accounts/doctype/payment_entry/test_payment_entry.py

@@ -733,6 +733,23 @@ class TestPaymentEntry(FrappeTestCase):
 
 		self.validate_gl_entries(pe.name, expected_gle)
 
+	def test_internal_transfer_rejects_same_account(self):
+		pe = frappe.new_doc("Payment Entry")
+		pe.payment_type = "Internal Transfer"
+		pe.company = "_Test Company"
+		pe.paid_from = "_Test Bank - _TC"
+		pe.paid_to = "_Test Bank - _TC"
+		pe.paid_amount = 100
+		pe.received_amount = 100
+		pe.reference_no = "same-account-transfer"
+		pe.reference_date = nowdate()
+
+		self.assertRaisesRegex(
+			frappe.ValidationError,
+			"Paid From and Paid To accounts must be different",
+			pe.insert,
+		)
+
 	def test_payment_against_negative_sales_invoice(self):
 		si1 = create_sales_invoice()
 

erpnext/accounts/doctype/payment_entry_deduction/payment_entry_deduction.json

@@ -10,7 +10,8 @@
   "amount",
   "column_break_2",
   "is_exchange_gain_loss",
-  "description"
+  "description",
+  "dunning"
  ],
  "fields": [
   {
@@ -55,12 +56,21 @@
    "fieldtype": "Check",
    "label": "Is Exchange Gain / Loss?",
    "read_only": 1
+  },
+  {
+   "fieldname": "dunning",
+   "fieldtype": "Link",
+   "label": "Dunning",
+   "no_copy": 1,
+   "options": "Dunning",
+   "print_hide": 1,
+   "read_only": 1
   }
  ],
  "index_web_pages_for_search": 1,
  "istable": 1,
  "links": [],
- "modified": "2026-03-11 14:26:11.312950",
+ "modified": "2026-08-17 11:20:35.482913",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Payment Entry Deduction",

erpnext/accounts/doctype/payment_entry_deduction/payment_entry_deduction.py

@@ -18,6 +18,7 @@ class PaymentEntryDeduction(Document):
 		amount: DF.Currency
 		cost_center: DF.Link
 		description: DF.SmallText | None
+		dunning: DF.Link | None
 		is_exchange_gain_loss: DF.Check
 		parent: DF.Data
 		parentfield: DF.Data

erpnext/accounts/doctype/payment_order/payment_order.py

@@ -57,32 +57,63 @@ class PaymentOrder(Document):
 			frappe.db.set_value(self.payment_order_type, d.get(ref_doc_field), ref_field, status)
 
 
+def _readable_payment_order(filters):
+	"""Authorise the parent before reading its rows.
+
+	A child table carries no permissions of its own, so a read of it has to be authorised on the
+	Payment Order the rows belong to.
+	"""
+	parent = filters.get("parent")
+	if not parent or not frappe.db.exists("Payment Order", parent):
+		return None
+
+	ptype = "select" if frappe.only_has_select_perm("Payment Order") else "read"
+	frappe.has_permission("Payment Order", ptype, doc=parent, throw=True)
+	return parent
+
+
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_mop_query(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		""" select mode_of_payment from `tabPayment Order Reference`
-		where parent = %(parent)s and mode_of_payment like %(txt)s
-		limit %(page_len)s offset %(start)s""",
-		{"parent": filters.get("parent"), "start": start, "page_len": page_len, "txt": "%%%s%%" % txt},
+	if not _readable_payment_order(filters):
+		return []
+
+	return frappe.get_all(
+		"Payment Order Reference",
+		filters={"parent": filters.get("parent"), "mode_of_payment": ["like", f"%{txt}%"]},
+		fields=["mode_of_payment"],
+		limit_start=start,
+		limit_page_length=page_len,
+		order_by="",  # match the original query (no ORDER BY); avoid get_all's default sort
+		as_list=True,
 	)
 
 
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_supplier_query(doctype, txt, searchfield, start, page_len, filters):
-	return frappe.db.sql(
-		""" select supplier from `tabPayment Order Reference`
-		where parent = %(parent)s and supplier like %(txt)s and
-		(payment_reference is null or payment_reference='')
-		limit %(page_len)s offset %(start)s""",
-		{"parent": filters.get("parent"), "start": start, "page_len": page_len, "txt": "%%%s%%" % txt},
+	if not _readable_payment_order(filters):
+		return []
+
+	return frappe.get_all(
+		"Payment Order Reference",
+		filters={
+			"parent": filters.get("parent"),
+			"supplier": ["like", f"%{txt}%"],
+			"payment_reference": ["is", "not set"],
+		},
+		fields=["supplier"],
+		limit_start=start,
+		limit_page_length=page_len,
+		order_by="",  # match the original query (no ORDER BY); avoid get_all's default sort
+		as_list=True,
 	)
 
 
 @frappe.whitelist()
 def make_payment_records(name, supplier, mode_of_payment=None):
 	doc = frappe.get_doc("Payment Order", name)
+	doc.check_permission()
 	make_journal_entry(doc, supplier, mode_of_payment)
 
 

erpnext/accounts/doctype/payment_reconciliation/payment_reconciliation.py

@@ -455,6 +455,13 @@ class PaymentReconciliation(Document):
 		default_exchange_gain_loss_account = frappe.get_cached_value(
 			"Company", self.company, "exchange_gain_loss_account"
 		)
+		account_currency = frappe.get_cached_value(
+			"Account", self.receivable_payable_account, "account_currency"
+		)
+		allocated_amount_precision = get_field_precision(
+			frappe.get_meta("Payment Reconciliation Allocation").get_field("allocated_amount"),
+			currency=account_currency,
+		)
 
 		entries = []
 		for pay in args.get("payments"):
@@ -462,11 +469,17 @@ class PaymentReconciliation(Document):
 			for inv in args.get("invoices"):
 				if pay.get("amount") >= inv.get("outstanding_amount"):
 					res = self.get_allocated_entry(pay, inv, inv["outstanding_amount"])
-					pay["amount"] = flt(pay.get("amount")) - flt(inv.get("outstanding_amount"))
+					pay["amount"] = flt(
+						flt(pay.get("amount")) - flt(inv.get("outstanding_amount")),
+						allocated_amount_precision,
+					)
 					inv["outstanding_amount"] = 0
 				else:
 					res = self.get_allocated_entry(pay, inv, pay["amount"])
-					inv["outstanding_amount"] = flt(inv.get("outstanding_amount")) - flt(pay.get("amount"))
+					inv["outstanding_amount"] = flt(
+						flt(inv.get("outstanding_amount")) - flt(pay.get("amount")),
+						allocated_amount_precision,
+					)
 					pay["amount"] = 0
 
 				inv["exchange_rate"] = invoice_exchange_map.get(inv.get("invoice_number"))

erpnext/accounts/doctype/payment_reconciliation/test_payment_reconciliation.py

@@ -1484,6 +1484,75 @@ class TestPaymentReconciliation(FrappeTestCase):
 		# Should not raise frappe.exceptions.ValidationError: Payment Entry has been modified after you pulled it. Please pull it again.
 		pr.reconcile()
 
+	@change_settings("System Settings", {"currency_precision": 2})
+	def test_allocate_entries_rounds_running_balance_to_currency_precision(self):
+		pr = frappe.new_doc("Payment Reconciliation")
+		pr.company = self.company
+		pr.party_type = "Customer"
+		pr.party = self.customer
+		pr.receivable_payable_account = self.debit_to
+		pr.set("invoices", [{"invoice_number": "INV-1"}])
+		pr.set("payments", [{"reference_name": "PAY-1"}])
+
+		invoices = [
+			{
+				"invoice_type": "Sales Invoice",
+				"invoice_number": "INV-1",
+				"outstanding_amount": 17592.415,
+				"currency": "INR",
+			},
+		]
+		payments = [
+			{
+				"reference_type": "Payment Entry",
+				"reference_name": "PAY-1",
+				"amount": 18230,
+				"currency": "INR",
+			}
+		]
+
+		pr.allocate_entries(frappe._dict({"invoices": invoices, "payments": payments}))
+
+		self.assertEqual(payments[0]["amount"], flt(637.585, 2))
+
+	@change_settings("System Settings", {"currency_precision": "", "use_number_format_from_currency": 1})
+	def test_allocate_entries_rounds_running_balance_to_account_currency_precision(self):
+		account_currency = frappe.get_cached_value("Account", self.debit_to, "account_currency")
+		original_number_format = frappe.db.get_value("Currency", account_currency, "number_format")
+		frappe.db.set_value("Currency", account_currency, "number_format", "#,###.###")
+		self.addCleanup(
+			frappe.db.set_value, "Currency", account_currency, "number_format", original_number_format
+		)
+
+		pr = frappe.new_doc("Payment Reconciliation")
+		pr.company = self.company
+		pr.party_type = "Customer"
+		pr.party = self.customer
+		pr.receivable_payable_account = self.debit_to
+		pr.set("invoices", [{"invoice_number": "INV-1"}])
+		pr.set("payments", [{"reference_name": "PAY-1"}])
+
+		invoices = [
+			{
+				"invoice_type": "Sales Invoice",
+				"invoice_number": "INV-1",
+				"outstanding_amount": 17592.415,
+				"currency": account_currency,
+			},
+		]
+		payments = [
+			{
+				"reference_type": "Payment Entry",
+				"reference_name": "PAY-1",
+				"amount": 18230,
+				"currency": account_currency,
+			}
+		]
+
+		pr.allocate_entries(frappe._dict({"invoices": invoices, "payments": payments}))
+
+		self.assertEqual(payments[0]["amount"], flt(637.585, 3))
+
 	def test_reverse_payment_against_payment_for_supplier(self):
 		"""
 		Reconcile a payment against a reverse payment, for a supplier.

erpnext/accounts/doctype/payment_request/payment_request.py

@@ -461,7 +461,7 @@ class PaymentRequest(Document):
 		}
 
 		if self.message:
-			return frappe.render_template(self.message, context)
+			return frappe.render_template(self.message, context, restrict_globals=True)
 
 	def set_failed(self):
 		pass

erpnext/accounts/doctype/payment_term/payment_term.json

@@ -116,7 +116,7 @@
   }
  ],
  "links": [],
- "modified": "2021-02-15 20:30:56.256403",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Payment Term",
@@ -157,6 +157,30 @@
    "role": "Accounts User",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Purchase Manager",
+   "select": 1
+  },
+  {
+   "role": "Purchase User",
+   "select": 1
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "quick_entry": 1,

erpnext/accounts/doctype/period_closing_voucher/period_closing_voucher.py

@@ -54,7 +54,7 @@ class PeriodClosingVoucher(AccountsController):
 		if for_cancellation and is_immutable_ledger_enabled():
 			posting_date = getdate()
 
-		check_freezing_date(posting_date, self.company)
+		check_freezing_date(posting_date)
 
 	def validate_start_and_end_date(self):
 		self.fy_start_date, self.fy_end_date = frappe.db.get_value(

erpnext/accounts/doctype/pos_closing_entry/pos_closing_entry.py

@@ -147,12 +147,22 @@ class POSClosingEntry(StatusUpdater):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_cashiers(doctype, txt, searchfield, start, page_len, filters):
+	pos_profile = filters.get("parent")
+	if not pos_profile or not frappe.db.exists("POS Profile", pos_profile):
+		return []
+
+	ptype = "select" if frappe.only_has_select_perm("POS Profile") else "read"
+	frappe.has_permission("POS Profile", ptype, doc=pos_profile, throw=True)
+
 	cashiers_list = frappe.get_all("POS Profile User", filters=filters, fields=["user"], as_list=1)
 	return [c for c in cashiers_list]
 
 
 @frappe.whitelist()
 def get_pos_invoices(start, end, pos_profile, user):
+	frappe.has_permission("POS Profile", doc=pos_profile, throw=True)
+	frappe.has_permission("POS Invoice", throw=True)
+
 	data = frappe.db.sql(
 		"""
 	select

erpnext/accounts/doctype/pos_invoice/pos_invoice.json

@@ -499,6 +499,7 @@
   },
   {
    "collapsible": 1,
+   "collapsible_depends_on": "eval:doc.currency && doc.currency != erpnext.get_currency(doc.company)",
    "depends_on": "customer",
    "fieldname": "currency_and_price_list",
    "fieldtype": "Section Break",
@@ -1571,7 +1572,7 @@
  "icon": "fa fa-file-text",
  "is_submittable": 1,
  "links": [],
- "modified": "2026-02-22 04:18:50.691218",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "POS Invoice",
@@ -1614,6 +1615,14 @@
    "permlevel": 1,
    "read": 1,
    "role": "All"
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
+  },
+  {
+   "role": "Sales User",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/pos_invoice/pos_invoice.py

@@ -801,6 +801,21 @@ class POSInvoice(SalesInvoice):
 
 @frappe.whitelist()
 def get_stock_availability(item_code, warehouse):
+	# POS Profile is the only boundary that fits: Item/Bin `read` exclude Accounts Manager, Item
+	# `select` is granted to every desk user, and POS Invoice `read` is granted to `All`.
+	# select-or-read: the shipped rows give Sales Manager only `select`.
+	ptype = "select" if frappe.only_has_select_perm("POS Profile") else "read"
+	frappe.has_permission("POS Profile", ptype, throw=True)
+
+	# the caller picks the warehouse when allow_warehouse_change is set; costs nobody who has no
+	# Warehouse User Permission
+	from frappe.permissions import get_allowed_docs_for_doctype, get_user_permissions
+
+	if warehouse_permissions := get_user_permissions(frappe.session.user).get("Warehouse"):
+		allowed_warehouses = get_allowed_docs_for_doctype(warehouse_permissions, "POS Invoice")
+		if allowed_warehouses and warehouse not in allowed_warehouses:
+			frappe.throw(_("Not permitted for {0}").format(warehouse), frappe.PermissionError)
+
 	if frappe.db.get_value("Item", item_code, "is_stock_item"):
 		is_stock_item = True
 		bin_qty = get_bin_qty(item_code, warehouse)

erpnext/accounts/doctype/pos_invoice_merge_log/pos_invoice_merge_log.py

@@ -217,6 +217,8 @@ class POSInvoiceMergeLog(Document):
 
 		loyalty_amount_sum, loyalty_points_sum, idx = 0, 0, 1
 
+		reversed_rows = get_reversed_rows([doc.return_against for doc in data if doc.is_return])
+
 		for doc in data:
 			map_doc(doc, invoice, table_map={"doctype": invoice.doctype})
 
@@ -239,9 +241,13 @@ class POSInvoiceMergeLog(Document):
 				si_item.pos_invoice = doc.name
 				si_item.pos_invoice_item = item.name
 				if doc.is_return:
-					si_item.sales_invoice_item = get_sales_invoice_item(
-						doc.return_against, item.pos_invoice_item
-					)
+					reversed_row = reversed_rows.get(item.pos_invoice_item) or frappe._dict()
+					si_item.sales_invoice_item = reversed_row.get("name")
+					# quote the rate of the row being reversed: rounding an invoice-level discount
+					# can leave a return's net rate a minor unit above the sale's, and
+					# validate_returned_items refuses a return priced above its original
+					if si_item.sales_invoice_item:
+						si_item.rate = reversed_row.rate
 				if item.serial_and_batch_bundle:
 					si_item.serial_and_batch_bundle = item.serial_and_batch_bundle
 				items.append(si_item)
@@ -439,6 +445,29 @@ def update_item_wise_tax_detail(consolidate_tax_row, tax_row):
 	consolidate_tax_row.item_wise_tax_detail = json.dumps(consolidated_tax_detail, separators=(",", ":"))
 
 
+def get_reversed_rows(return_against):
+	"""Rows of the consolidated sales these returns reverse, keyed by the POS invoice row."""
+	if not return_against:
+		return {}
+
+	sales_invoice = DocType("Sales Invoice")
+	sales_invoice_item = DocType("Sales Invoice Item")
+
+	rows = (
+		frappe.qb.from_(sales_invoice)
+		.from_(sales_invoice_item)
+		.select(sales_invoice_item.name, sales_invoice_item.rate, sales_invoice_item.pos_invoice_item)
+		.where(
+			(sales_invoice.name == sales_invoice_item.parent)
+			& (sales_invoice.is_return == 0)
+			& (sales_invoice_item.pos_invoice.isin(return_against))
+			& (sales_invoice.docstatus == 1)
+		)
+	).run(as_dict=True)
+
+	return {row.pos_invoice_item: row for row in rows}
+
+
 def get_all_unconsolidated_invoices():
 	filters = {
 		"consolidated_invoice": ["in", ["", None]],
@@ -683,27 +712,3 @@ def get_error_message(message) -> str:
 		return message["message"]
 	except Exception:
 		return str(message)
-
-
-def get_sales_invoice_item(return_against_pos_invoice, pos_invoice_item):
-	try:
-		SalesInvoice = DocType("Sales Invoice")
-		SalesInvoiceItem = DocType("Sales Invoice Item")
-
-		query = (
-			frappe.qb.from_(SalesInvoice)
-			.from_(SalesInvoiceItem)
-			.select(SalesInvoiceItem.name)
-			.where(
-				(SalesInvoice.name == SalesInvoiceItem.parent)
-				& (SalesInvoice.is_return == 0)
-				& (SalesInvoiceItem.pos_invoice == return_against_pos_invoice)
-				& (SalesInvoiceItem.pos_invoice_item == pos_invoice_item)
-				& (SalesInvoice.docstatus == 1)
-			)
-		)
-
-		result = query.run(as_dict=True)
-		return result[0].name if result else None
-	except Exception:
-		return None

erpnext/accounts/doctype/pos_invoice_merge_log/test_pos_invoice_merge_log.py

@@ -3,9 +3,11 @@
 
 import json
 import unittest
+from contextlib import contextmanager
 
 import frappe
 from frappe.tests.utils import change_settings
+from frappe.utils import flt
 
 from erpnext.accounts.doctype.pos_closing_entry.test_pos_closing_entry import init_user_and_profile
 from erpnext.accounts.doctype.pos_invoice.pos_invoice import make_sales_return
@@ -19,6 +21,67 @@ from erpnext.stock.doctype.serial_and_batch_bundle.test_serial_and_batch_bundle
 from erpnext.stock.doctype.stock_entry.stock_entry_utils import make_stock_entry
 
 
+@contextmanager
+def rounding_method(method):
+	"""System Settings is also cached on frappe.local, so that copy has to go as well."""
+	previous = frappe.db.get_single_value("System Settings", "rounding_method")
+	try:
+		frappe.db.set_single_value("System Settings", "rounding_method", method)
+		frappe.local.system_settings = None
+		yield
+	finally:
+		frappe.db.set_single_value("System Settings", "rounding_method", previous)
+		frappe.local.system_settings = None
+
+
+def sell_over_the_counter(lines, discount_percentage=0):
+	item_code, qty, rate = lines[0]
+	sale = create_pos_invoice(item_code=item_code, qty=qty, rate=rate, do_not_save=True)
+	for item_code, qty, rate in lines[1:]:
+		sale.append(
+			"items",
+			{
+				"item_code": item_code,
+				"qty": qty,
+				"rate": rate,
+				"price_list_rate": rate,
+				"warehouse": "_Test Warehouse - _TC",
+				"income_account": "Sales - _TC",
+				"cost_center": "_Test Cost Center - _TC",
+			},
+		)
+
+	if discount_percentage:
+		sale.apply_discount_on = "Net Total"
+		sale.additional_discount_percentage = discount_percentage
+
+	sale.run_method("calculate_taxes_and_totals")
+	payable = sale.rounded_total or sale.grand_total
+	sale.append("payments", {"mode_of_payment": "Cash", "account": "Cash - _TC", "amount": payable})
+	sale.paid_amount = sale.base_paid_amount = payable
+	sale.insert()
+	sale.submit()
+	return sale
+
+
+def refund_over_the_counter(sale, qty=None):
+	"""Hand back every line of `sale`, `qty` of each when fewer units come back."""
+	note = make_sales_return(sale.name)
+	if qty is not None:
+		for item in note.items:
+			item.qty = qty
+
+	note.run_method("calculate_taxes_and_totals")
+	refundable = note.rounded_total or note.grand_total
+	note.payments[0].amount = refundable
+	for spare in note.payments[1:]:
+		spare.amount = 0
+	note.paid_amount = note.base_paid_amount = refundable
+	note.insert()
+	note.submit()
+	return note
+
+
 class TestPOSInvoiceMergeLog(unittest.TestCase):
 	def test_consolidated_invoice_creation(self):
 		frappe.db.sql("delete from `tabPOS Invoice`")
@@ -510,3 +573,92 @@ class TestPOSInvoiceMergeLog(unittest.TestCase):
 			frappe.set_user("Administrator")
 			frappe.db.sql("delete from `tabPOS Profile`")
 			frappe.db.sql("delete from `tabPOS Invoice`")
+
+	@change_settings("Selling Settings", {"allow_multiple_items": 1})
+	def test_consolidating_returns_priced_off_a_rounded_invoice_discount(self):
+		"""A return works out its own share of an invoice-level discount, so rounding can leave
+		it a minor unit above the sale's, and validate_returned_items then refuses it.
+
+		Every shape that reaches a consolidated credit note goes through one consolidation:
+		a split landing on a half minor unit, the same item on two rows so the rows can only
+		be paired through sales_invoice_item, fewer units coming back than went out, and — as
+		a control — a sale with no invoice-level discount to split at all.
+		"""
+		frappe.db.sql("delete from `tabPOS Invoice`")
+
+		try:
+			for item_code in ("_Test Item", "_Test Item 2"):
+				make_stock_entry(to_warehouse="_Test Warehouse - _TC", item_code=item_code, rate=100, qty=40)
+			init_user_and_profile()
+
+			with rounding_method("Banker's Rounding (legacy)"):
+				tied = sell_over_the_counter(
+					[("_Test Item", 1, 42.86), ("_Test Item 2", 1, 57.14)], discount_percentage=25
+				)
+				repeated = sell_over_the_counter(
+					[("_Test Item", 1, 42.86), ("_Test Item", 1, 57.14)], discount_percentage=25
+				)
+				oversold = sell_over_the_counter(
+					[("_Test Item", 3, 42.86), ("_Test Item 2", 3, 57.14)], discount_percentage=25
+				)
+				undiscounted = sell_over_the_counter([("_Test Item", 1, 42.86), ("_Test Item 2", 1, 57.14)])
+
+				# the sale and the return really do round the split apart
+				self.assertEqual(
+					{item.item_code: item.net_rate for item in tied.items},
+					{"_Test Item": 32.15, "_Test Item 2": 42.85},
+				)
+				returns = [
+					refund_over_the_counter(tied),
+					refund_over_the_counter(repeated),
+					refund_over_the_counter(oversold, qty=-1),
+					refund_over_the_counter(undiscounted),
+				]
+				self.assertEqual(
+					{item.item_code: item.net_rate for item in returns[0].items},
+					{"_Test Item": 32.14, "_Test Item 2": 42.86},
+				)
+
+				consolidate_pos_invoices()
+
+			for pos_invoice in [tied, repeated, oversold, undiscounted, *returns]:
+				pos_invoice.load_from_db()
+				self.assertTrue(
+					frappe.db.exists("Sales Invoice", pos_invoice.consolidated_invoice),
+					f"{pos_invoice.name} was not consolidated",
+				)
+				self.assertEqual(
+					frappe.db.get_value(
+						"Sales Invoice", pos_invoice.consolidated_invoice, "outstanding_amount"
+					),
+					0,
+				)
+
+			for note in returns:
+				# no returned row may be priced above the row it reverses
+				for row in frappe.get_all(
+					"Sales Invoice Item",
+					filters={"parent": note.consolidated_invoice},
+					fields=["item_code", "rate", "sales_invoice_item"],
+				):
+					self.assertTrue(row.sales_invoice_item, f"{row.item_code} lost its link to the sale")
+					sold_rate = frappe.db.get_value("Sales Invoice Item", row.sales_invoice_item, "rate")
+					self.assertLessEqual(row.rate, sold_rate)
+
+			# returns for one customer land on a single credit note, which still adds up to
+			# everything handed back over the counter
+			refunded = {}
+			for note in returns:
+				refunded[note.consolidated_invoice] = refunded.get(note.consolidated_invoice, 0) + flt(
+					note.grand_total
+				)
+			for consolidated_name, handed_back in refunded.items():
+				self.assertEqual(
+					flt(frappe.db.get_value("Sales Invoice", consolidated_name, "grand_total"), 2),
+					flt(handed_back, 2),
+				)
+
+		finally:
+			frappe.set_user("Administrator")
+			frappe.db.sql("delete from `tabPOS Profile`")
+			frappe.db.sql("delete from `tabPOS Invoice`")

erpnext/accounts/doctype/pos_profile/pos_profile.json

@@ -422,7 +422,7 @@
    "link_fieldname": "pos_profile"
   }
  ],
- "modified": "2026-02-22 04:17:03.308876",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "POS Profile",
@@ -446,6 +446,10 @@
    "read": 1,
    "report": 1,
    "role": "Accounts User"
+  },
+  {
+   "role": "Sales Manager",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/pos_profile/pos_profile.py

@@ -271,40 +271,40 @@ def pos_profile_query(doctype, txt, searchfield, start, page_len, filters):
 	user = frappe.session["user"]
 	company = filters.get("company") or frappe.defaults.get_user_default("company")
 
-	args = {
-		"user": user,
-		"start": start,
-		"company": company,
-		"page_len": page_len,
-		"txt": "%%%s%%" % txt,
-	}
+	allowed_pos_profiles = frappe.get_list("POS Profile", pluck="name")
 
-	pos_profile = frappe.db.sql(
-		"""select pf.name
-		from
-			`tabPOS Profile` pf, `tabPOS Profile User` pfu
-		where
-			pfu.parent = pf.name and pfu.user = %(user)s and pf.company = %(company)s
-			and (pf.name like %(txt)s)
-			and pf.disabled = 0 limit %(page_len)s offset %(start)s""",
-		args,
+	if not allowed_pos_profiles:
+		return {}
+
+	pf = frappe.qb.DocType("POS Profile")
+	pfu = frappe.qb.DocType("POS Profile User")
+
+	pos_profile = (
+		frappe.qb.from_(pf)
+		.inner_join(pfu)
+		.on(pfu.parent == pf.name)
+		.select(pf.name)
+		.where((pfu.user == user) & (pf.company == company) & pf.name.like(f"%{txt}%") & (pf.disabled == 0))
+		.where(pf.name.isin(allowed_pos_profiles))
+		.limit(page_len)
+		.offset(start)
+		.run()
 	)
 
 	if not pos_profile:
-		del args["user"]
-
-		pos_profile = frappe.db.sql(
-			"""select pf.name
-			from
-				`tabPOS Profile` pf left join `tabPOS Profile User` pfu
-			on
-				pf.name = pfu.parent
-			where
-				ifnull(pfu.user, '') = ''
-				and pf.company = %(company)s
-				and pf.name like %(txt)s
-				and pf.disabled = 0""",
-			args,
+		pos_profile = (
+			frappe.qb.from_(pf)
+			.left_join(pfu)
+			.on(pf.name == pfu.parent)
+			.select(pf.name)
+			.where(
+				(pfu.user.isnull() | (pfu.user == ""))
+				& (pf.company == company)
+				& pf.name.like(f"%{txt}%")
+				& (pf.disabled == 0)
+				& (pf.name.isin(allowed_pos_profiles))
+			)
+			.run()
 		)
 
 	return pos_profile

erpnext/accounts/doctype/pos_search_fields/pos_search_fields.json

@@ -12,20 +12,22 @@
   {
    "fieldname": "fieldname",
    "fieldtype": "Data",
-   "hidden": 1,
-   "label": "Fieldname"
+   "in_list_view": 1,
+   "label": "Fieldname",
+   "read_only": 1
   },
   {
    "fieldname": "field",
    "fieldtype": "Select",
    "in_list_view": 1,
-   "label": "Field"
+   "label": "Field",
+   "reqd": 1
   }
  ],
  "index_web_pages_for_search": 1,
  "istable": 1,
  "links": [],
- "modified": "2021-04-21 11:12:54.632093",
+ "modified": "2026-08-31 20:41:12.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "POS Search Fields",
@@ -34,4 +36,4 @@
  "sort_field": "modified",
  "sort_order": "DESC",
  "track_changes": 1
-}
+}

erpnext/accounts/doctype/pos_settings/pos_settings.js

@@ -1,40 +1,9 @@
 // Copyright (c) 2017, Frappe Technologies Pvt. Ltd. and contributors
 // For license information, please see license.txt
 
-let search_fields_datatypes = [
-	"Data",
-	"Link",
-	"Dynamic Link",
-	"Long Text",
-	"Select",
-	"Small Text",
-	"Text",
-	"Text Editor",
-];
-let do_not_include_fields = [
-	"naming_series",
-	"item_code",
-	"item_name",
-	"stock_uom",
-	"asset_naming_series",
-	"default_material_request_type",
-	"valuation_method",
-	"warranty_period",
-	"weight_uom",
-	"batch_number_series",
-	"serial_no_series",
-	"purchase_uom",
-	"customs_tariff_number",
-	"sales_uom",
-	"deferred_revenue_account",
-	"deferred_expense_account",
-	"quality_inspection_template",
-	"route",
-	"slideshow",
-	"website_image_alt",
-	"thumbnail",
-	"web_long_description",
-];
+function is_valid_invoice_field(df) {
+	return frappe.model.no_value_type.indexOf(df.fieldtype) === -1 || df.fieldtype === "Button";
+}
 
 frappe.ui.form.on("POS Settings", {
 	onload: function (frm) {
@@ -44,57 +13,46 @@ frappe.ui.form.on("POS Settings", {
 
 	get_invoice_fields: function (frm) {
 		frappe.model.with_doctype("POS Invoice", () => {
-			var fields = $.map(frappe.get_doc("DocType", "POS Invoice").fields, function (d) {
-				if (
-					frappe.model.no_value_type.indexOf(d.fieldtype) === -1 ||
-					["Button"].includes(d.fieldtype)
-				) {
-					return { label: d.label + " (" + d.fieldtype + ")", value: d.fieldname };
-				} else {
-					return null;
-				}
-			});
+			const fields = frappe.get_doc("DocType", "POS Invoice").fields.filter(is_valid_invoice_field);
 
 			frm.fields_dict.invoice_fields.grid.update_docfield_property(
 				"fieldname",
 				"options",
-				[""].concat(fields)
+				[""].concat(
+					fields.map((df) => {
+						return { label: `${df.label} (${df.fieldtype})`, value: df.fieldname };
+					})
+				)
 			);
 		});
 	},
 
 	add_search_options: function (frm) {
-		frappe.model.with_doctype("Item", () => {
-			var fields = $.map(frappe.get_doc("DocType", "Item").fields, function (d) {
-				if (
-					search_fields_datatypes.includes(d.fieldtype) &&
-					!do_not_include_fields.includes(d.fieldname)
-				) {
-					return [d.label];
-				} else {
-					return null;
-				}
-			});
+		frappe.call({
+			method: "erpnext.accounts.doctype.pos_settings.pos_settings.get_pos_search_field_options",
+			callback: ({ message }) => {
+				const fields = message || [];
 
-			fields.unshift("");
-			frm.fields_dict.pos_search_fields.grid.update_docfield_property("field", "options", fields);
+				frm.searchable_item_fields = Object.fromEntries(
+					fields.map((df) => [df.option, df.fieldname])
+				);
+
+				frm.fields_dict.pos_search_fields.grid.update_docfield_property(
+					"field",
+					"options",
+					[""].concat(fields.map((df) => df.option))
+				);
+			},
 		});
 	},
 });
 
 frappe.ui.form.on("POS Search Fields", {
 	field: function (frm, doctype, name) {
-		var doc = frappe.get_doc(doctype, name);
-		var df = $.map(frappe.get_doc("DocType", "Item").fields, function (d) {
-			if (doc.field == d.label && search_fields_datatypes.includes(d.fieldtype)) {
-				return d;
-			} else {
-				return null;
-			}
-		})[0];
+		const doc = frappe.get_doc(doctype, name);
 
-		doc.fieldname = df.fieldname;
-		frm.refresh_field("fields");
+		doc.fieldname = frm.searchable_item_fields?.[doc.field] || "";
+		frm.refresh_field("pos_search_fields");
 	},
 });
 
@@ -110,6 +68,6 @@ frappe.ui.form.on("POS Field", {
 		doc.options = df.options;
 		doc.fieldtype = df.fieldtype;
 		doc.default_value = df.default;
-		frm.refresh_field("fields");
+		frm.refresh_field("invoice_fields");
 	},
 });

erpnext/accounts/doctype/pos_settings/pos_settings.py

@@ -1,9 +1,50 @@
 # Copyright (c) 2017, Frappe Technologies Pvt. Ltd. and contributors
 # For license information, please see license.txt
 
+from collections import Counter
 
+import frappe
+from frappe import _
+from frappe.model import no_value_fields
 from frappe.model.document import Document
 
+SEARCH_FIELD_TYPES = (
+	"Data",
+	"Link",
+	"Dynamic Link",
+	"Long Text",
+	"Select",
+	"Small Text",
+	"Text",
+	"Text Editor",
+)
+
+# Item fields that are of a searchable fieldtype, but are not meaningful to search a POS item by
+DO_NOT_INCLUDE_FIELDS = (
+	"naming_series",
+	"item_code",
+	"item_name",
+	"stock_uom",
+	"asset_naming_series",
+	"default_material_request_type",
+	"valuation_method",
+	"warranty_period",
+	"weight_uom",
+	"batch_number_series",
+	"serial_no_series",
+	"purchase_uom",
+	"customs_tariff_number",
+	"sales_uom",
+	"deferred_revenue_account",
+	"deferred_expense_account",
+	"quality_inspection_template",
+	"route",
+	"slideshow",
+	"website_image_alt",
+	"thumbnail",
+	"web_long_description",
+)
+
 
 class POSSettings(Document):
 	# begin: auto-generated types
@@ -22,4 +63,95 @@ class POSSettings(Document):
 	# end: auto-generated types
 
 	def validate(self):
-		pass
+		self.validate_duplicate_invoice_fields()
+		self.validate_invoice_fields()
+		self.validate_duplicate_pos_search_fields()
+		self.validate_pos_search_fields()
+
+	def validate_duplicate_invoice_fields(self):
+		fieldnames = [field.fieldname for field in self.invoice_fields]
+
+		for fieldname, count in Counter(fieldnames).items():
+			if count > 1:
+				frappe.throw(
+					title=_("Duplicate POS Fields"), msg=_("'{0}' has been already added.").format(fieldname)
+				)
+
+	def validate_invoice_fields(self):
+		# the POS screen only ever creates a POS Invoice
+		meta = frappe.get_meta("POS Invoice")
+
+		for field in self.invoice_fields:
+			df = meta.get_field(field.fieldname)
+
+			if not df or not is_valid_invoice_field(df):
+				frappe.throw(
+					title=_("Invalid POS Field"),
+					msg=_("Row #{0}: '{1}' is not a valid field of {2}.").format(
+						field.idx, frappe.bold(field.fieldname or ""), frappe.bold(_("POS Invoice"))
+					),
+				)
+
+			# read only in the form, so keep them in sync with the invoice
+			field.label = df.label
+			field.fieldtype = df.fieldtype
+			field.options = df.options
+
+	def validate_duplicate_pos_search_fields(self):
+		fieldnames = [field.fieldname for field in self.pos_search_fields]
+
+		for fieldname, count in Counter(fieldnames).items():
+			if count > 1:
+				frappe.throw(
+					title=_("Duplicate POS Search Fields"),
+					msg=_("'{0}' has been already added.").format(fieldname),
+				)
+
+	def validate_pos_search_fields(self):
+		searchable_fields = {df.fieldname: df for df in get_searchable_item_fields()}
+
+		for field in self.pos_search_fields:
+			df = searchable_fields.get(field.fieldname)
+
+			if not df:
+				frappe.throw(
+					title=_("Invalid POS Search Field"),
+					msg=_("Row #{0}: '{1}' cannot be used to search items.").format(
+						field.idx, frappe.bold(field.fieldname or "")
+					),
+				)
+
+			if field.field != get_search_field_option(df):
+				frappe.throw(
+					title=_("Invalid POS Search Field"),
+					msg=_("Row #{0}: '{1}' does not match {2}.").format(
+						field.idx, frappe.bold(field.field or ""), frappe.bold(df.fieldname)
+					),
+				)
+
+
+def is_valid_invoice_field(df):
+	return df.fieldtype not in no_value_fields or df.fieldtype == "Button"
+
+
+def get_searchable_item_fields():
+	return [
+		df
+		for df in frappe.get_meta("Item").fields
+		if df.fieldtype in SEARCH_FIELD_TYPES and df.fieldname not in DO_NOT_INCLUDE_FIELDS
+	]
+
+
+def get_search_field_option(df):
+	# the fieldname keeps the option unique, two Item fields can share a label
+	return f"{df.label} ({df.fieldname})"
+
+
+@frappe.whitelist()
+def get_pos_search_field_options():
+	frappe.has_permission("POS Settings", throw=True)
+
+	return [
+		{"option": get_search_field_option(df), "fieldname": df.fieldname}
+		for df in get_searchable_item_fields()
+	]

erpnext/accounts/doctype/pos_settings/test_pos_settings.py

@@ -3,6 +3,119 @@
 
 import unittest
 
+import frappe
+
+from erpnext.patches.v16_0.append_fieldname_to_pos_search_fields import execute as append_fieldname
+
 
 class TestPOSSettings(unittest.TestCase):
-	pass
+	def setUp(self):
+		self.settings = frappe.get_single("POS Settings")
+		self.settings.invoice_fields = []
+		self.settings.pos_search_fields = []
+
+	def tearDown(self):
+		frappe.db.rollback()
+
+	def assertInvalid(self, message):
+		with self.assertRaises(frappe.ValidationError) as context:
+			self.settings.save()
+
+		self.assertIn(message, str(context.exception))
+
+	def test_duplicate_invoice_field_is_not_allowed(self):
+		self.settings.append("invoice_fields", {"fieldname": "customer"})
+		self.settings.append("invoice_fields", {"fieldname": "customer"})
+		self.assertInvalid("'customer' has been already added.")
+
+	def test_unknown_invoice_field_is_not_allowed(self):
+		self.settings.append("invoice_fields", {"fieldname": "not_a_field"})
+		self.assertInvalid("is not a valid field of")
+
+	def test_layout_invoice_field_is_not_allowed(self):
+		self.settings.append("invoice_fields", {"fieldname": "accounting_dimensions_section"})
+		self.assertInvalid("is not a valid field of")
+
+	def test_invoice_field_properties_are_set_from_the_invoice(self):
+		self.settings.append(
+			"invoice_fields", {"fieldname": "customer", "label": "Tampered", "fieldtype": "Data"}
+		)
+		self.settings.save()
+
+		field = self.settings.invoice_fields[0]
+		self.assertEqual(field.label, "Customer")
+		self.assertEqual(field.fieldtype, "Link")
+		self.assertEqual(field.options, "Customer")
+
+	def test_searchable_item_field_is_allowed(self):
+		self.settings.append(
+			"pos_search_fields", {"field": "Description (description)", "fieldname": "description"}
+		)
+		self.settings.save()
+
+		self.assertEqual(self.settings.pos_search_fields[0].fieldname, "description")
+
+	def test_excluded_search_field_is_not_allowed(self):
+		self.settings.append(
+			"pos_search_fields", {"field": "Item Name (item_name)", "fieldname": "item_name"}
+		)
+		self.assertInvalid("cannot be used to search items")
+
+	def test_search_field_of_unsearchable_type_is_not_allowed(self):
+		# maintain stock is a Check field
+		self.settings.append(
+			"pos_search_fields", {"field": "Maintain Stock (is_stock_item)", "fieldname": "is_stock_item"}
+		)
+		self.assertInvalid("cannot be used to search items")
+
+	def test_unknown_search_field_is_not_allowed(self):
+		self.settings.append(
+			"pos_search_fields", {"field": "Nope (not_an_item_field)", "fieldname": "not_an_item_field"}
+		)
+		self.assertInvalid("cannot be used to search items")
+
+	def test_search_field_without_a_fieldname_is_not_allowed(self):
+		# the form fills the fieldname in, it cannot be picked on its own
+		self.settings.append("pos_search_fields", {"field": "Description (description)"})
+		self.assertInvalid("cannot be used to search items")
+
+	def test_search_field_option_must_match_its_fieldname(self):
+		self.settings.append("pos_search_fields", {"field": "Brand (brand)", "fieldname": "description"})
+		self.assertInvalid("does not match")
+
+	def test_bare_label_is_not_accepted_as_a_search_field(self):
+		# the stored option carries the fieldname, the patch backfills older rows
+		self.settings.append("pos_search_fields", {"field": "Description", "fieldname": "description"})
+		self.assertInvalid("does not match")
+
+	def test_duplicate_search_fields_are_not_allowed(self):
+		for _ in range(2):
+			self.settings.append(
+				"pos_search_fields", {"field": "Description (description)", "fieldname": "description"}
+			)
+
+		self.assertInvalid("has been already added")
+
+	def test_patch_appends_the_fieldname_to_a_legacy_search_field(self):
+		self.settings.append(
+			"pos_search_fields", {"field": "Description (description)", "fieldname": "description"}
+		)
+		self.settings.save()
+
+		row = self.settings.pos_search_fields[0].name
+		frappe.db.set_value("POS Search Fields", row, "field", "Description", update_modified=False)
+
+		append_fieldname()
+
+		self.assertEqual(frappe.db.get_value("POS Search Fields", row, "field"), "Description (description)")
+
+	def test_patch_leaves_an_already_migrated_search_field_alone(self):
+		self.settings.append(
+			"pos_search_fields", {"field": "Description (description)", "fieldname": "description"}
+		)
+		self.settings.save()
+
+		append_fieldname()
+
+		row = self.settings.pos_search_fields[0].name
+		self.assertEqual(frappe.db.get_value("POS Search Fields", row, "field"), "Description (description)")

erpnext/accounts/doctype/pricing_rule/pricing_rule.py

@@ -12,6 +12,29 @@ from frappe import _, throw
 from frappe.model.document import Document
 from frappe.utils import cint, flt
 
+# the transactions the pricing engine is called for, from transaction.js and the POS
+PRICING_TRANSACTION_DOCTYPES = frozenset(
+	{
+		"Quotation",
+		"Sales Order",
+		"Delivery Note",
+		"Sales Invoice",
+		"POS Invoice",
+		"Supplier Quotation",
+		"Purchase Order",
+		"Purchase Receipt",
+		"Purchase Invoice",
+		"Material Request",
+		# these three also extend a controller that calls the pricing engine: BOM and BOM Creator
+		# through TransactionController, Request for Quotation through BuyingController
+		"BOM",
+		"BOM Creator",
+		"Request for Quotation",
+		# no client sends this one, but set_transaction_type below still branches on it
+		"Opportunity",
+	}
+)
+
 apply_on_dict = {"Item Code": "items", "Item Group": "item_groups", "Brand": "brands"}
 
 other_fields = ["other_item_code", "other_item_group", "other_brand"]
@@ -364,6 +387,18 @@ def apply_pricing_rule(args, doc=None):
 
 	args = frappe._dict(args)
 
+	# an allow-list, not a type check: `doctype` is caller-chosen, and any doctype the caller can
+	# read would otherwise satisfy the has_permission below while the pricing engine still ran
+	transaction_doctype = args.get("doctype")
+	if transaction_doctype not in PRICING_TRANSACTION_DOCTYPES:
+		frappe.throw(_("Invalid doctype"), frappe.PermissionError)
+
+	transaction_name = args.get("name")
+	if not isinstance(transaction_name, str) or not frappe.db.exists(transaction_doctype, transaction_name):
+		transaction_name = None
+
+	frappe.has_permission(transaction_doctype, doc=transaction_name, throw=True)
+
 	set_transaction_type(args)
 
 	# list of dictionaries
@@ -733,14 +768,18 @@ def make_pricing_rule(doctype, docname):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_item_uoms(doctype, txt, searchfield, start, page_len, filters):
-	items = [filters.get("value")]
-	if filters.get("apply_on") != "Item Code":
-		field = frappe.scrub(filters.get("apply_on"))
-		items = [d.name for d in frappe.db.get_all("Item", filters={field: filters.get("value")})]
+	if filters.get("apply_on") == "Item Code":
+		item_filters = [["name", "=", filters.get("value")]]
+	else:
+		item_filters = [[frappe.scrub(filters.get("apply_on")), "=", filters.get("value")]]
+
+	items = frappe.get_list("Item", filters=item_filters, pluck="name")
+	if not items:
+		return []
 
 	return frappe.get_all(
 		"UOM Conversion Detail",
-		filters={"parent": ("in", items), "uom": ("like", f"{txt}%")},
+		filters={"parent": ("in", items), "parenttype": "Item", "uom": ("like", f"{txt}%")},
 		fields=["distinct uom"],
 		as_list=1,
 	)

erpnext/accounts/doctype/process_period_closing_voucher/process_period_closing_voucher.py

@@ -130,15 +130,20 @@ def initialize_parallel_threads(docname: str):
 		frappe.db.set_value("Process Period Closing Voucher", docname, "status", "Completed")
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def start_pcv_processing(docname: str):
+	# checked before the status is read, not inside the branch: otherwise an unentitled caller
+	# learns the document's status from whether this returns or throws
+	frappe.has_permission("Process Period Closing Voucher", "write", doc=docname, throw=True)
+
 	if frappe.db.get_value("Process Period Closing Voucher", docname, "status") in ["Queued", "Running"]:
-		frappe.has_permission("Process Period Closing Voucher", "write", doc=docname, throw=True)
 		initialize_parallel_threads(docname)
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def pause_pcv_processing(docname: str):
+	frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True)
+
 	ppcv = qb.DocType("Process Period Closing Voucher")
 	qb.update(ppcv).set(ppcv.status, "Paused").where(ppcv.name.eq(docname)).run()
 
@@ -152,8 +157,10 @@ def pause_pcv_processing(docname: str):
 		qb.update(ppcvd).set(ppcvd.status, "Paused").where(ppcvd.name.isin(queued_dates)).run()
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def cancel_pcv_processing(docname: str):
+	frappe.has_permission("Process Period Closing Voucher", ptype="cancel", doc=docname, throw=True)
+
 	ppcv = qb.DocType("Process Period Closing Voucher")
 	qb.update(ppcv).set(ppcv.status, "Cancelled").where(ppcv.name.eq(docname)).run()
 
@@ -166,8 +173,10 @@ def cancel_pcv_processing(docname: str):
 		qb.update(ppcvd).set(ppcvd.status, "Cancelled").where(ppcvd.name.isin(queued_dates)).run()
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def resume_pcv_processing(docname: str):
+	frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True)
+
 	ppcv = qb.DocType("Process Period Closing Voucher")
 	qb.update(ppcv).set(ppcv.status, "Running").where(ppcv.name.eq(docname)).run()
 
@@ -249,8 +258,11 @@ def get_gle_for_closing_account(pcv, dimension_balance, dimensions):
 	return gl_entry
 
 
-@frappe.whitelist()
+@frappe.whitelist(methods=["POST"])
 def schedule_next_date(docname: str):
+	# marks a row Running and enqueues a long job, so it needs the same write check as the sibling controls
+	frappe.has_permission("Process Period Closing Voucher", ptype="write", doc=docname, throw=True)
+
 	timeout = frappe.db.get_single_value("Accounts Settings", "pcv_job_timeout") or 3600
 	ppcvd = qb.DocType("Process Period Closing Voucher Detail")
 

erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py

@@ -293,6 +293,13 @@ def get_html(doc, filters, entry, col, res, ageing):
 		from frappe.www.printview import get_letter_head
 
 		letter_head = get_letter_head(doc, 0)
+		# render letter head content as a template so its Jinja resolves against the doc
+		if letter_head.get("content"):
+			# nosemgrep: frappe-semgrep-rules.rules.security.frappe-ssti
+			letter_head["content"] = frappe.render_template(letter_head["content"], {"doc": doc})
+		if letter_head.get("footer"):
+			# nosemgrep: frappe-semgrep-rules.rules.security.frappe-ssti
+			letter_head["footer"] = frappe.render_template(letter_head["footer"], {"doc": doc})
 	html = frappe.render_template(
 		template_path,
 		{

erpnext/accounts/doctype/purchase_invoice/purchase_invoice.js

@@ -78,7 +78,7 @@ erpnext.accounts.PurchaseInvoice = class PurchaseInvoice extends erpnext.buying.
 		const me = this;
 		super.refresh();
 
-		hide_fields(this.frm.doc);
+		hide_fields(this.frm);
 		// Show / Hide button
 		this.show_general_ledger();
 		erpnext.accounts.ledger_preview.show_accounting_ledger_preview(this.frm);
@@ -237,10 +237,8 @@ erpnext.accounts.PurchaseInvoice = class PurchaseInvoice extends erpnext.buying.
 
 	unblock_invoice() {
 		const me = this;
-		frappe.call({
-			method: "erpnext.accounts.doctype.purchase_invoice.purchase_invoice.unblock_invoice",
-			args: { name: me.frm.doc.name },
-			callback: (r) => me.frm.reload_doc(),
+		me.frm.call("unblock_invoice", null, () => {
+			me.frm.reload_doc();
 		});
 	}
 
@@ -291,15 +289,16 @@ erpnext.accounts.PurchaseInvoice = class PurchaseInvoice extends erpnext.buying.
 
 		this.dialog.set_primary_action(__("Save"), function () {
 			const dialog_data = me.dialog.get_values();
-			frappe.call({
-				method: "erpnext.accounts.doctype.purchase_invoice.purchase_invoice.block_invoice",
-				args: {
-					name: me.frm.doc.name,
+			me.frm.call(
+				"block_invoice",
+				{
 					hold_comment: dialog_data.hold_comment,
 					release_date: dialog_data.release_date,
 				},
-				callback: (r) => me.frm.reload_doc(),
-			});
+				() => {
+					me.frm.reload_doc();
+				}
+			);
 			me.dialog.hide();
 		});
 
@@ -338,10 +337,9 @@ erpnext.accounts.PurchaseInvoice = class PurchaseInvoice extends erpnext.buying.
 	}
 
 	set_release_date(data) {
-		return frappe.call({
-			method: "erpnext.accounts.doctype.purchase_invoice.purchase_invoice.change_release_date",
-			args: data,
-			callback: (r) => this.frm.reload_doc(),
+		const me = this;
+		return me.frm.call("change_release_date", { release_date: data.release_date }, () => {
+			me.frm.reload_doc();
 		});
 	}
 
@@ -437,7 +435,7 @@ erpnext.accounts.PurchaseInvoice = class PurchaseInvoice extends erpnext.buying.
 	}
 
 	is_paid() {
-		hide_fields(this.frm.doc);
+		hide_fields(this.frm);
 		if (cint(this.frm.doc.is_paid)) {
 			this.frm.set_value("allocate_advances_automatically", 0);
 			this.frm.set_value("payment_terms_template", "");
@@ -501,28 +499,26 @@ cur_frm.script_manager.make(erpnext.accounts.PurchaseInvoice);
 
 // Hide Fields
 // ------------
-function hide_fields(doc) {
-	var parent_fields = ["due_date", "is_opening", "advances_section", "from_date", "to_date"];
+function hide_fields(frm) {
+	const doc = frm.doc;
+	const parent_fields = ["due_date", "is_opening", "advances_section", "from_date", "to_date"];
 
 	if (cint(doc.is_paid) == 1) {
-		hide_field(parent_fields);
+		frm.toggle_display(parent_fields, false);
 	} else {
-		for (var i in parent_fields) {
-			var docfield = frappe.meta.docfield_map[doc.doctype][parent_fields[i]];
-			if (!docfield.hidden) unhide_field(parent_fields[i]);
+		for (const fieldname of parent_fields) {
+			const docfield = frappe.meta.docfield_map[doc.doctype][fieldname];
+			if (!docfield.hidden) frm.toggle_display(fieldname, true);
 		}
 	}
 
-	var item_fields_stock = ["warehouse_section", "received_qty", "rejected_qty"];
+	const item_fields_stock = ["warehouse_section", "received_qty", "rejected_qty"];
 
-	if (cur_frm.fields_dict["items"]) {
-		cur_frm.fields_dict["items"].grid.set_column_disp(
-			item_fields_stock,
-			cint(doc.update_stock) == 1 || cint(doc.is_return) == 1 ? true : false
-		);
+	if (frm.fields_dict["items"]) {
+		frm.fields_dict["items"].grid.set_column_disp(item_fields_stock, cint(doc.update_stock) == 1);
 	}
 
-	cur_frm.refresh_fields();
+	frm.refresh_fields();
 }
 
 cur_frm.fields_dict.cash_bank_account.get_query = function (doc) {
@@ -738,7 +734,7 @@ frappe.ui.form.on("Purchase Invoice", {
 	},
 
 	update_stock: function (frm) {
-		hide_fields(frm.doc);
+		hide_fields(frm);
 		frm.fields_dict.items.grid.toggle_reqd("item_code", frm.doc.update_stock ? true : false);
 	},
 

erpnext/accounts/doctype/purchase_invoice/purchase_invoice.json

@@ -352,6 +352,7 @@
   {
    "collapsible": 1,
    "collapsible_depends_on": "eval:doc.on_hold",
+   "depends_on": "eval:doc.on_hold",
    "fieldname": "sb_14",
    "fieldtype": "Section Break",
    "label": "Hold Invoice"
@@ -501,6 +502,7 @@
   },
   {
    "collapsible": 1,
+   "collapsible_depends_on": "eval:doc.currency && doc.currency != erpnext.get_currency(doc.company)",
    "fieldname": "currency_and_price_list",
    "fieldtype": "Section Break",
    "label": "Currency and Price List",
@@ -1662,7 +1664,7 @@
  "idx": 204,
  "is_submittable": 1,
  "links": [],
- "modified": "2026-07-12 23:54:21.263951",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Purchase Invoice",
@@ -1715,6 +1717,18 @@
    "read": 1,
    "role": "Accounts Manager",
    "write": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Quality Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "row_format": "Dynamic",

erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py

@@ -8,7 +8,7 @@ import frappe
 from frappe import _, qb, throw
 from frappe.model.mapper import get_mapped_doc
 from frappe.query_builder.functions import Sum
-from frappe.utils import cint, cstr, flt, formatdate, get_link_to_form, getdate, nowdate
+from frappe.utils import DateTimeLikeObject, cint, cstr, flt, formatdate, get_link_to_form, getdate, nowdate
 
 import erpnext
 from erpnext.accounts.deferred_revenue import validate_service_stop_date
@@ -40,6 +40,7 @@ from erpnext.assets.doctype.asset_category.asset_category import get_asset_categ
 from erpnext.buying.utils import check_on_hold_or_closed_status
 from erpnext.controllers.accounts_controller import merge_taxes, validate_account_head
 from erpnext.controllers.buying_controller import BuyingController
+from erpnext.controllers.mapper import get_qty_already_mapped
 from erpnext.stock import get_warehouse_account_map
 from erpnext.stock.doctype.purchase_receipt.purchase_receipt import (
 	get_item_account_wise_additional_cost,
@@ -291,6 +292,7 @@ class PurchaseInvoice(BuyingController):
 		self.validate_multiple_billing("Purchase Receipt", "pr_detail", "amount")
 		self.set_status()
 		self.validate_purchase_receipt_if_update_stock()
+		self.validate_exchange_rate_with_purchase_receipt()
 		validate_inter_company_party(
 			self.doctype, self.supplier, self.company, self.inter_company_invoice_reference
 		)
@@ -299,6 +301,9 @@ class PurchaseInvoice(BuyingController):
 		self.reset_default_field_value("set_from_warehouse", "items", "from_warehouse")
 		self.set_percentage_received()
 
+		if self.on_hold:
+			self.validate_invoice_hold()
+
 	def set_percentage_received(self):
 		total_billed_qty = 0.0
 		total_received_qty = 0.0
@@ -310,6 +315,54 @@ class PurchaseInvoice(BuyingController):
 		if total_billed_qty and total_received_qty:
 			self.per_received = total_received_qty / total_billed_qty * 100
 
+	def validate_exchange_rate_with_purchase_receipt(self):
+		if self.is_internal_transfer() or not erpnext.is_perpetual_inventory_enabled(self.company):
+			return
+
+		stock_items = self.get_stock_items()
+		receipts = {
+			item.purchase_receipt
+			for item in self.items
+			if item.purchase_receipt and item.item_code in stock_items
+		}
+		if not receipts:
+			return
+
+		if frappe.db.get_single_value("Buying Settings", "set_landed_cost_based_on_purchase_invoice_rate"):
+			return
+
+		mismatched = [
+			f"{frappe.bold(row.name)} ({row.conversion_rate})"
+			for row in frappe.get_all(
+				"Purchase Receipt",
+				filters={"name": ("in", list(receipts))},
+				fields=["name", "currency", "conversion_rate"],
+			)
+			if row.currency == self.currency
+			and flt(row.conversion_rate)
+			and flt(row.conversion_rate) != flt(self.conversion_rate)
+		]
+		if not mismatched:
+			return
+
+		frappe.throw(
+			_(
+				"Exchange rate {0} does not match the exchange rate of Purchase Receipt {1}. Use the same exchange rate as the Purchase Receipt or enable {2} in {3} to adjust the landed cost based on this invoice."
+			).format(
+				frappe.bold(self.conversion_rate),
+				", ".join(mismatched),
+				frappe.bold(_("Set Landed Cost Based on Purchase Invoice Rate")),
+				get_link_to_form("Buying Settings", "Buying Settings", _("Buying Settings")),
+			)
+		)
+
+	def validate_invoice_hold(self):
+		if self.is_return:
+			frappe.throw(_("Return Purchase Invoice cannot be held."))
+
+		if self.docstatus < 1:
+			frappe.throw(_("Purchase Invoice can be held after submitting."))
+
 	def validate_release_date(self):
 		if self.release_date and getdate(nowdate()) >= getdate(self.release_date):
 			frappe.throw(_("Release date must be in the future"))
@@ -386,6 +439,9 @@ class PurchaseInvoice(BuyingController):
 		self.party_account_currency = account.account_currency
 
 	def check_on_hold_or_closed_status(self):
+		if self.get("is_return"):
+			return
+
 		check_list = []
 
 		for d in self.get("items"):
@@ -1365,7 +1421,20 @@ class PurchaseInvoice(BuyingController):
 			)
 
 			if flt(stock_amount, net_amt_precision) != flt(warehouse_debit_amount, net_amt_precision):
-				cost_of_goods_sold_account = self.get_company_default("default_expense_account")
+				stock_asset_rbnb = (
+					self.get_company_default("asset_received_but_not_billed", ignore_validation=True)
+					if item.is_fixed_asset
+					else self.get_company_default("stock_received_but_not_billed", ignore_validation=True)
+				)
+				fallback_account = (
+					(item.expense_account or stock_asset_rbnb)
+					if self.is_return
+					else (stock_asset_rbnb or item.expense_account)
+				)
+				cost_of_goods_sold_account = (
+					self.get_company_default("default_expense_account", ignore_validation=True)
+					or fallback_account
+				)
 				stock_adjustment_amt = stock_amount - warehouse_debit_amount
 
 				gl_entries.append(
@@ -1390,7 +1459,20 @@ class PurchaseInvoice(BuyingController):
 			and warehouse_debit_amount
 			!= flt(voucher_wise_stock_value.get((item.name, item.warehouse)), net_amt_precision)
 		):
-			cost_of_goods_sold_account = self.get_company_default("default_expense_account")
+			stock_asset_rbnb = (
+				self.get_company_default("asset_received_but_not_billed", ignore_validation=True)
+				if item.is_fixed_asset
+				else self.get_company_default("stock_received_but_not_billed", ignore_validation=True)
+			)
+			fallback_account = (
+				(item.expense_account or stock_asset_rbnb)
+				if self.is_return
+				else (stock_asset_rbnb or item.expense_account)
+			)
+			cost_of_goods_sold_account = (
+				self.get_company_default("default_expense_account", ignore_validation=True)
+				or fallback_account
+			)
 			stock_amount = flt(voucher_wise_stock_value.get((item.name, item.warehouse)), net_amt_precision)
 			stock_adjustment_amt = warehouse_debit_amount - stock_amount
 
@@ -1855,14 +1937,38 @@ class PurchaseInvoice(BuyingController):
 	def on_recurring(self, reference_doc, auto_repeat_doc):
 		self.due_date = None
 
-	def block_invoice(self, hold_comment=None, release_date=None):
-		self.db_set("on_hold", 1)
-		self.db_set("hold_comment", cstr(hold_comment))
+	@frappe.whitelist(methods=["POST"])
+	def block_invoice(self, hold_comment: str | None = None, release_date: DateTimeLikeObject | None = None):
+		self.check_permission("write")
+		self.on_hold = 1
+		self.release_date = release_date
+		self.validate_block_invoice()
+
+		self.db_set({"on_hold": 1, "hold_comment": cstr(hold_comment), "release_date": release_date})
+
+	@frappe.whitelist(methods=["POST"])
+	def unblock_invoice(self):
+		self.check_permission("write")
+		self.db_set({"on_hold": 0, "release_date": None})
+
+	@frappe.whitelist(methods=["POST"])
+	def change_release_date(self, release_date: DateTimeLikeObject | None = None):
+		self.check_permission("write")
+
+		if not self.on_hold:
+			frappe.throw(_("Invoice is not blocked. Block the invoice to change the release date."))
+
+		self.release_date = release_date
+		self.validate_block_invoice()
+
 		self.db_set("release_date", release_date)
 
-	def unblock_invoice(self):
-		self.db_set("on_hold", 0)
-		self.db_set("release_date", None)
+	def validate_block_invoice(self):
+		self.validate_invoice_hold()
+		if self.outstanding_amount <= 0:
+			frappe.throw(_("Purchase Invoice without any outstanding amount cannot be held."))
+
+		self.validate_release_date()
 
 	def set_tax_withholding(self):
 		self.set("advance_tax", [])
@@ -2082,28 +2188,6 @@ def make_stock_entry(source_name, target_doc=None):
 	return doc
 
 
-@frappe.whitelist()
-def change_release_date(name, release_date=None):
-	if frappe.db.exists("Purchase Invoice", name):
-		pi = frappe.get_doc("Purchase Invoice", name)
-		pi.check_permission()
-		pi.db_set("release_date", release_date)
-
-
-@frappe.whitelist()
-def unblock_invoice(name):
-	if frappe.db.exists("Purchase Invoice", name):
-		pi = frappe.get_doc("Purchase Invoice", name)
-		pi.unblock_invoice()
-
-
-@frappe.whitelist()
-def block_invoice(name, release_date, hold_comment=None):
-	if frappe.db.exists("Purchase Invoice", name):
-		pi = frappe.get_doc("Purchase Invoice", name)
-		pi.block_invoice(hold_comment, release_date)
-
-
 @frappe.whitelist()
 def make_inter_company_sales_invoice(source_name, target_doc=None):
 	from erpnext.accounts.doctype.sales_invoice.sales_invoice import make_inter_company_transaction
@@ -2118,6 +2202,11 @@ def make_purchase_receipt(source_name, target_doc=None, args=None):
 	if isinstance(args, str):
 		args = json.loads(args)
 
+	mapped_qty_by_item = get_qty_already_mapped(target_doc, "purchase_invoice_item")
+
+	def received_and_mapped_qty(obj):
+		return flt(obj.received_qty) + flt(mapped_qty_by_item.get(obj.name, 0))
+
 	def post_parent_process(source_parent, target_parent):
 		remove_items_with_zero_qty(target_parent)
 		set_missing_values(source_parent, target_parent)
@@ -2132,13 +2221,13 @@ def make_purchase_receipt(source_name, target_doc=None, args=None):
 		target_parent.run_method("calculate_taxes_and_totals")
 
 	def update_item(obj, target, source_parent):
-		target.qty = flt(obj.qty) - flt(obj.received_qty)
-		target.received_qty = flt(obj.qty) - flt(obj.received_qty)
-		target.stock_qty = (flt(obj.qty) - flt(obj.received_qty)) * flt(obj.conversion_factor)
-		target.amount = (flt(obj.qty) - flt(obj.received_qty)) * flt(obj.rate)
-		target.base_amount = (
-			(flt(obj.qty) - flt(obj.received_qty)) * flt(obj.rate) * flt(source_parent.conversion_rate)
-		)
+		pending_qty = flt(obj.qty) - received_and_mapped_qty(obj)
+
+		target.qty = pending_qty
+		target.received_qty = pending_qty
+		target.stock_qty = pending_qty * flt(obj.conversion_factor)
+		target.amount = pending_qty * flt(obj.rate)
+		target.base_amount = pending_qty * flt(obj.rate) * flt(source_parent.conversion_rate)
 
 	def select_item(d):
 		filtered_items = args.get("filtered_children", [])
@@ -2168,7 +2257,8 @@ def make_purchase_receipt(source_name, target_doc=None, args=None):
 					"wip_composite_asset": "wip_composite_asset",
 				},
 				"postprocess": update_item,
-				"condition": lambda doc: abs(doc.received_qty) < abs(doc.qty) and select_item(doc),
+				"condition": lambda doc: abs(received_and_mapped_qty(doc)) < abs(doc.qty)
+				and select_item(doc),
 			},
 			"Purchase Taxes and Charges": {
 				"doctype": "Purchase Taxes and Charges",

erpnext/accounts/doctype/purchase_invoice/test_purchase_invoice.py

@@ -287,14 +287,166 @@ class TestPurchaseInvoice(FrappeTestCase, StockTestMixin):
 
 	def test_purchase_invoice_explicit_block(self):
 		pi = make_purchase_invoice()
-		pi.block_invoice()
+		release_date = add_days(nowdate(), 10)
+
+		pi.block_invoice(hold_comment="Waiting for the goods", release_date=release_date)
 
 		self.assertEqual(pi.on_hold, 1)
 
+		on_hold, hold_comment, saved_release_date = frappe.db.get_value(
+			"Purchase Invoice", pi.name, ["on_hold", "hold_comment", "release_date"]
+		)
+		self.assertEqual(on_hold, 1)
+		self.assertEqual(hold_comment, "Waiting for the goods")
+		self.assertEqual(getdate(saved_release_date), getdate(release_date))
+
 		pi.unblock_invoice()
 
 		self.assertEqual(pi.on_hold, 0)
 
+		on_hold, saved_release_date = frappe.db.get_value(
+			"Purchase Invoice", pi.name, ["on_hold", "release_date"]
+		)
+		self.assertEqual(on_hold, 0)
+		self.assertIsNone(saved_release_date)
+
+	def test_purchase_invoice_cannot_be_held_before_submission(self):
+		pi = make_purchase_invoice(do_not_save=True)
+		pi.on_hold = 1
+
+		self.assertRaises(frappe.ValidationError, pi.save)
+
+		pi.on_hold = 0
+		pi.save()
+		pi.submit()
+
+		pi.block_invoice()
+		self.assertEqual(frappe.db.get_value("Purchase Invoice", pi.name, "on_hold"), 1)
+
+	def test_return_purchase_invoice_cannot_be_held(self):
+		from erpnext.controllers.sales_and_purchase_return import make_return_doc
+
+		pi = make_purchase_invoice()
+
+		return_pi = make_return_doc(pi.doctype, pi.name)
+		return_pi.on_hold = 1
+		self.assertRaisesRegex(frappe.ValidationError, "cannot be held", return_pi.save)
+
+		return_pi.on_hold = 0
+		return_pi.save()
+		return_pi.submit()
+
+		self.assertRaisesRegex(frappe.ValidationError, "cannot be held", return_pi.block_invoice)
+
+	def test_return_purchase_invoice_is_not_affected_by_hold_validations(self):
+		from erpnext.controllers.sales_and_purchase_return import make_return_doc
+
+		pi = make_purchase_invoice()
+
+		# a return has a negative outstanding amount, which must not be mistaken
+		# for an invalid hold on a document that was never held
+		return_pi = make_return_doc(pi.doctype, pi.name)
+		return_pi.save()
+		return_pi.submit()
+
+		self.assertEqual(return_pi.docstatus, 1)
+		self.assertEqual(return_pi.on_hold, 0)
+		self.assertLess(return_pi.outstanding_amount, 0)
+
+	def test_settled_purchase_invoice_cannot_be_held(self):
+		pi = make_purchase_invoice()
+
+		pe = get_payment_entry("Purchase Invoice", dn=pi.name, bank_account="_Test Bank - _TC")
+		pe.reference_no = "1"
+		pe.reference_date = nowdate()
+		pe.save()
+		pe.submit()
+
+		pi.reload()
+		self.assertEqual(pi.outstanding_amount, 0)
+
+		self.assertRaises(frappe.ValidationError, pi.block_invoice)
+		self.assertEqual(frappe.db.get_value("Purchase Invoice", pi.name, "on_hold"), 0)
+
+	def test_release_date_of_held_invoice_must_be_in_future(self):
+		pi = make_purchase_invoice()
+
+		self.assertRaises(frappe.ValidationError, pi.block_invoice, "Hold", add_days(nowdate(), -1))
+		self.assertRaises(frappe.ValidationError, pi.block_invoice, "Hold", nowdate())
+
+	def test_rejected_hold_does_not_partially_update_invoice(self):
+		pi = make_purchase_invoice()
+
+		self.assertRaises(frappe.ValidationError, pi.block_invoice, "Hold", add_days(nowdate(), -1))
+
+		pi.reload()
+		self.assertEqual(pi.on_hold, 0)
+		self.assertIsNone(pi.release_date)
+
+	def test_change_release_date_of_held_invoice(self):
+		pi = make_purchase_invoice()
+		pi.block_invoice(hold_comment="Hold", release_date=add_days(nowdate(), 10))
+
+		new_release_date = add_days(nowdate(), 20)
+		pi.change_release_date(new_release_date)
+
+		self.assertEqual(
+			getdate(frappe.db.get_value("Purchase Invoice", pi.name, "release_date")),
+			getdate(new_release_date),
+		)
+
+		self.assertRaises(frappe.ValidationError, pi.change_release_date, add_days(nowdate(), -1))
+
+	def test_release_date_cannot_be_changed_on_an_invoice_that_is_not_held(self):
+		pi = make_purchase_invoice()
+
+		self.assertRaisesRegex(
+			frappe.ValidationError,
+			"Invoice is not blocked",
+			pi.change_release_date,
+			add_days(nowdate(), 10),
+		)
+
+		self.assertIsNone(frappe.db.get_value("Purchase Invoice", pi.name, "release_date"))
+
+	def test_hold_methods_are_whitelisted_document_methods(self):
+		import erpnext.accounts.doctype.purchase_invoice.purchase_invoice as purchase_invoice_module
+
+		pi = frappe.new_doc("Purchase Invoice")
+
+		for method in ("block_invoice", "unblock_invoice", "change_release_date"):
+			# raises if the method is not whitelisted for client side calls
+			pi.is_whitelisted(method)
+
+			self.assertFalse(
+				hasattr(purchase_invoice_module, method),
+				f"{method} should only be exposed as a document method",
+			)
+
+	def test_hold_methods_require_write_permission(self):
+		pi = make_purchase_invoice()
+		user = "test_pi_hold_permission@example.com"
+
+		if not frappe.db.exists("User", user):
+			frappe.get_doc(
+				{
+					"doctype": "User",
+					"email": user,
+					"first_name": "Test PI Hold",
+					"roles": [{"role": "Employee"}],
+				}
+			).insert(ignore_permissions=True)
+
+		frappe.set_user(user)
+		try:
+			self.assertRaises(frappe.PermissionError, pi.block_invoice)
+			self.assertRaises(frappe.PermissionError, pi.unblock_invoice)
+			self.assertRaises(frappe.PermissionError, pi.change_release_date, add_days(nowdate(), 10))
+		finally:
+			frappe.set_user("Administrator")
+
+		self.assertEqual(frappe.db.get_value("Purchase Invoice", pi.name, "on_hold"), 0)
+
 	def test_gl_entries_with_perpetual_inventory_against_pr(self):
 		pr = make_purchase_receipt(
 			company="_Test Company with perpetual inventory",
@@ -361,6 +513,12 @@ class TestPurchaseInvoice(FrappeTestCase, StockTestMixin):
 		)
 
 		frappe.db.set_single_value("Buying Settings", "set_landed_cost_based_on_purchase_invoice_rate", 0)
+		self.addCleanup(
+			frappe.db.set_single_value,
+			"Buying Settings",
+			"set_landed_cost_based_on_purchase_invoice_rate",
+			original_value,
+		)
 
 		pr = make_purchase_receipt(
 			company="_Test Company with perpetual inventory",
@@ -372,25 +530,15 @@ class TestPurchaseInvoice(FrappeTestCase, StockTestMixin):
 		pi = create_purchase_invoice(pr.name)
 		pi.conversion_rate = 80
 
+		self.assertRaises(frappe.ValidationError, pi.insert)
+
+		pi.conversion_rate = 70
 		pi.insert()
 		pi.submit()
 
-		# Get exchnage gain and loss account
 		exchange_gain_loss_account = frappe.db.get_value("Company", pi.company, "exchange_gain_loss_account")
-
-		# fetching the latest GL Entry with exchange gain and loss account account
-		amount = frappe.db.get_value(
-			"GL Entry", {"account": exchange_gain_loss_account, "voucher_no": pi.name}, "debit"
-		)
-
-		discrepancy_caused_by_exchange_rate_diff = abs(
-			pi.items[0].base_net_amount - pr.items[0].base_net_amount
-		)
-
-		self.assertEqual(discrepancy_caused_by_exchange_rate_diff, amount)
-
-		frappe.db.set_single_value(
-			"Buying Settings", "set_landed_cost_based_on_purchase_invoice_rate", original_value
+		self.assertFalse(
+			frappe.db.exists("GL Entry", {"account": exchange_gain_loss_account, "voucher_no": pi.name})
 		)
 
 	def test_purchase_invoice_with_exchange_rate_difference_for_non_stock_item(self):
@@ -398,11 +546,21 @@ class TestPurchaseInvoice(FrappeTestCase, StockTestMixin):
 			make_purchase_invoice as create_purchase_invoice,
 		)
 
-		# Creating Purchase Invoice with USD currency
+		original_value = frappe.db.get_single_value(
+			"Buying Settings", "set_landed_cost_based_on_purchase_invoice_rate"
+		)
+		frappe.db.set_single_value("Buying Settings", "set_landed_cost_based_on_purchase_invoice_rate", 0)
+		self.addCleanup(
+			frappe.db.set_single_value,
+			"Buying Settings",
+			"set_landed_cost_based_on_purchase_invoice_rate",
+			original_value,
+		)
+
 		pr = frappe.new_doc("Purchase Receipt")
 		pr.currency = "USD"
 		pr.company = "_Test Company with perpetual inventory"
-		pr.conversion_rate = (70,)
+		pr.conversion_rate = 80
 		pr.supplier = "_Test Supplier USD"
 		pr.append(
 			"items",
@@ -412,34 +570,20 @@ class TestPurchaseInvoice(FrappeTestCase, StockTestMixin):
 				"rate": 100,
 			},
 		)
-		pr.append(
-			"items",
-			{"item_code": "_Test Item", "qty": 1, "rate": 5, "warehouse": "Stores - TCP1"},
-		)
 		pr.insert()
 		pr.submit()
 
-		# Createing purchase invoice against Purchase Receipt
 		pi = create_purchase_invoice(pr.name)
-		pi.conversion_rate = 80
+		pi.conversion_rate = 70
 		pi.credit_to = "_Test Payable USD - TCP1"
 		pi.insert()
 		pi.submit()
 
-		# Get exchnage gain and loss account
 		exchange_gain_loss_account = frappe.db.get_value("Company", pi.company, "exchange_gain_loss_account")
-
-		# fetching the latest GL Entry with exchange gain and loss account account
-		amount = frappe.db.get_value(
-			"GL Entry", {"account": exchange_gain_loss_account, "voucher_no": pi.name}, "debit"
+		self.assertFalse(
+			frappe.db.exists("GL Entry", {"account": exchange_gain_loss_account, "voucher_no": pi.name})
 		)
 
-		discrepancy_caused_by_exchange_rate_diff = abs(
-			pi.items[1].base_net_amount - pr.items[1].base_net_amount
-		)
-
-		self.assertEqual(discrepancy_caused_by_exchange_rate_diff, amount)
-
 	def test_purchase_invoice_change_naming_series(self):
 		pi = frappe.copy_doc(test_records[1])
 		pi.insert()
@@ -1510,6 +1654,96 @@ class TestPurchaseInvoice(FrappeTestCase, StockTestMixin):
 		)
 		frappe.db.set_value("Company", "_Test Company", "exchange_gain_loss_account", original_account)
 
+	def test_stock_adjustment_account_fallbacks_when_default_expense_account_unset(self):
+		from erpnext.accounts.doctype.purchase_invoice.purchase_invoice import PurchaseInvoice
+
+		class StockAdjustmentInvoice:
+			company = "_Test Company"
+			conversion_rate = 1
+			update_stock = 1
+			is_internal_supplier = 0
+			return_against = None
+			project = None
+
+			def __init__(self, is_return, defaults):
+				self.is_return = is_return
+				self.defaults = defaults
+
+			def get(self, fieldname):
+				return None
+
+			def get_company_default(self, fieldname, ignore_validation=False):
+				return self.defaults.get(fieldname)
+
+			def get_gl_dict(self, args, *unused_args, **unused_kwargs):
+				return frappe._dict(args)
+
+		def make_invoice(is_return, defaults):
+			return StockAdjustmentInvoice(is_return, defaults)
+
+		def make_item(is_fixed_asset=0, expense_account="Item Expense - _TC"):
+			return frappe._dict(
+				{
+					"name": "row-1",
+					"warehouse": "Stores - _TC",
+					"valuation_rate": 10,
+					"qty": 10,
+					"conversion_factor": 1,
+					"base_net_amount": 100,
+					"item_tax_amount": 0,
+					"landed_cost_voucher_amount": 0,
+					"sales_incoming_rate": 0,
+					"is_fixed_asset": is_fixed_asset,
+					"expense_account": expense_account,
+					"cost_center": "Main - _TC",
+					"project": None,
+					"precision": lambda fieldname: 2,
+				}
+			)
+
+		defaults = {
+			"default_expense_account": None,
+			"stock_received_but_not_billed": "Stock Received But Not Billed - _TC",
+			"asset_received_but_not_billed": "Asset Received But Not Billed - _TC",
+		}
+		test_cases = (
+			(
+				"company default expense",
+				0,
+				make_item(),
+				{**defaults, "default_expense_account": "Default Expense - _TC"},
+				"Default Expense - _TC",
+			),
+			("stock rbnb", 0, make_item(), defaults, "Stock Received But Not Billed - _TC"),
+			(
+				"asset rbnb",
+				0,
+				make_item(is_fixed_asset=1),
+				defaults,
+				"Asset Received But Not Billed - _TC",
+			),
+			("return item expense", 1, make_item(), defaults, "Item Expense - _TC"),
+			(
+				"return without item expense",
+				1,
+				make_item(expense_account=None),
+				defaults,
+				"Stock Received But Not Billed - _TC",
+			),
+		)
+
+		for label, is_return, item, company_defaults, expected_account in test_cases:
+			with self.subTest(label=label):
+				invoice = make_invoice(is_return, company_defaults)
+				gl_entries = []
+				PurchaseInvoice.make_stock_adjustment_entry(
+					invoice, gl_entries, item, {(item.name, item.warehouse): 90}, "INR"
+				)
+
+				self.assertEqual(gl_entries[0].account, expected_account)
+				self.assertEqual(gl_entries[0].debit, 10)
+				self.assertEqual(gl_entries[0].debit_in_transaction_currency, 10)
+
 	@change_settings("Accounts Settings", {"unlink_payment_on_cancellation_of_invoice": 1})
 	def test_purchase_invoice_advance_taxes(self):
 		from erpnext.accounts.doctype.payment_entry.payment_entry import get_payment_entry
@@ -2457,6 +2691,39 @@ class TestPurchaseInvoice(FrappeTestCase, StockTestMixin):
 				self.assertEqual(row.serial_no, "\n".join(serial_nos[:2]))
 				self.assertEqual(row.rejected_serial_no, serial_nos[2])
 
+	def test_purchase_invoice_return_against_closed_purchase_order(self):
+		from erpnext.controllers.sales_and_purchase_return import make_return_doc
+
+		po = create_purchase_order(qty=2, rate=100)
+
+		invoices = []
+		for _ in range(2):
+			pi = make_pi_from_po(po.name)
+			pi.items[0].qty = 1
+			pi.submit()
+			invoices.append(pi)
+
+		make_return_doc("Purchase Invoice", invoices[0].name).submit()
+
+		po.reload()
+		po.update_status("Closed")
+
+		# a debit note against a closed Purchase Order should still go through,
+		# the same way a Sales Invoice return does against a closed Sales Order
+		debit_note = make_return_doc("Purchase Invoice", invoices[1].name)
+		debit_note.submit()
+
+		self.assertEqual(debit_note.docstatus, 1)
+		self.assertEqual(frappe.db.get_value("Purchase Order", po.name, "status"), "Closed")
+
+		# cancelling the debit note runs the same check on the closed order
+		debit_note.reload()
+		debit_note.cancel()
+
+		# a regular invoice against the closed order must still be blocked
+		blocked_pi = make_pi_from_po(po.name)
+		self.assertRaisesRegex(frappe.InvalidStatusError, "Closed", blocked_pi.save)
+
 	def test_make_pr_and_pi_from_po(self):
 		from erpnext.assets.doctype.asset.test_asset import create_asset_category
 
@@ -2814,6 +3081,23 @@ class TestPurchaseInvoice(FrappeTestCase, StockTestMixin):
 
 		self.assertRaises(StockOverReturnError, return_doc.save)
 
+	def test_partial_returns_ignore_received_qty_without_update_stock(self):
+		from erpnext.controllers.sales_and_purchase_return import make_return_doc
+
+		invoice = make_purchase_invoice(qty=10, received_qty=10)
+
+		first_return = make_return_doc(invoice.doctype, invoice.name)
+		first_return.items[0].qty = -4
+		first_return.save().submit()
+
+		self.assertEqual(first_return.items[0].received_qty, -10)
+
+		second_return = make_return_doc(invoice.doctype, invoice.name)
+		second_return.items[0].qty = -6
+		second_return.save().submit()
+
+		self.assertEqual(second_return.docstatus, 1)
+
 	def test_apply_discount_on_grand_total(self):
 		"""
 		To test if after applying discount on grand total,

erpnext/accounts/doctype/purchase_taxes_and_charges/purchase_taxes_and_charges.json

@@ -25,10 +25,12 @@
   "project",
   "section_break_9",
   "account_currency",
+  "net_amount",
   "tax_amount",
   "tax_amount_after_discount_amount",
   "total",
   "column_break_14",
+  "base_net_amount",
   "base_tax_amount",
   "base_total",
   "base_tax_amount_after_discount_amount",
@@ -213,11 +215,11 @@
    "fieldtype": "Column Break"
   },
   {
-    "allow_on_submit": 1,
-    "fieldname": "project",
-    "fieldtype": "Link",
-    "label": "Project",
-    "options": "Project"
+   "allow_on_submit": 1,
+   "fieldname": "project",
+   "fieldtype": "Link",
+   "label": "Project",
+   "options": "Project"
   },
   {
    "default": "0",
@@ -241,20 +243,38 @@
    "fieldtype": "Check",
    "label": "Is Tax Withholding Account",
    "read_only": 1
+  },
+  {
+   "description": "Basis for tax calculation",
+   "fieldname": "net_amount",
+   "fieldtype": "Currency",
+   "label": "Net Amount",
+   "options": "currency",
+   "read_only": 1
+  },
+  {
+   "description": "Basis for tax calculation",
+   "fieldname": "base_net_amount",
+   "fieldtype": "Currency",
+   "label": "Net Amount (Company Currency)",
+   "options": "Company:company:default_currency",
+   "read_only": 1
   }
  ],
  "grid_page_length": 50,
  "idx": 1,
  "istable": 1,
  "links": [],
- "modified": "2025-04-15 13:14:48.936047",
+ "modified": "2026-05-01 00:38:29.543523",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Purchase Taxes and Charges",
  "naming_rule": "Random",
  "owner": "Administrator",
  "permissions": [],
+ "row_format": "Dynamic",
  "sort_field": "modified",
  "sort_order": "DESC",
+ "states": [],
  "track_changes": 1
-}
+}

erpnext/accounts/doctype/purchase_taxes_and_charges/purchase_taxes_and_charges.py

@@ -17,6 +17,7 @@ class PurchaseTaxesandCharges(Document):
 		account_currency: DF.Link | None
 		account_head: DF.Link
 		add_deduct_tax: DF.Literal["Add", "Deduct"]
+		base_net_amount: DF.Currency
 		base_tax_amount: DF.Currency
 		base_tax_amount_after_discount_amount: DF.Currency
 		base_total: DF.Currency
@@ -35,9 +36,11 @@ class PurchaseTaxesandCharges(Document):
 		included_in_print_rate: DF.Check
 		is_tax_withholding_account: DF.Check
 		item_wise_tax_detail: DF.Code | None
+		net_amount: DF.Currency
 		parent: DF.Data
 		parentfield: DF.Data
 		parenttype: DF.Data
+		project: DF.Link | None
 		rate: DF.Float
 		row_id: DF.Data | None
 		tax_amount: DF.Currency

erpnext/accounts/doctype/purchase_taxes_and_charges_template/purchase_taxes_and_charges_template.json

@@ -77,7 +77,7 @@
  "icon": "fa fa-money",
  "idx": 1,
  "links": [],
- "modified": "2024-01-30 13:08:09.537242",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Purchase Taxes and Charges Template",
@@ -104,6 +104,22 @@
   {
    "read": 1,
    "role": "Purchase User"
+  },
+  {
+   "role": "Accounts Manager",
+   "select": 1
+  },
+  {
+   "role": "Accounts User",
+   "select": 1
+  },
+  {
+   "role": "Manufacturing Manager",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "show_title_field_in_link": 1,

erpnext/accounts/doctype/repost_accounting_ledger/repost_accounting_ledger.py

@@ -524,6 +524,10 @@ def validate_docs_for_voucher_types(doc_voucher_types):
 @frappe.whitelist()
 @frappe.validate_and_sanitize_search_inputs
 def get_repost_allowed_types(doctype, txt, searchfield, start, page_len, filters):
+	# `filters` goes straight to db.get_all, so reaching this needs gating rather than typing.
+	# Reached only from this doctype's own form, which is System-Manager-only.
+	frappe.has_permission("Repost Accounting Ledger", throw=True)
+
 	filters = {"allowed": True}
 
 	if txt:

erpnext/accounts/doctype/repost_payment_ledger/repost_payment_ledger.py

@@ -27,6 +27,7 @@ def start_payment_ledger_repost(docname=None):
 	"""
 	if docname:
 		repost_doc = frappe.get_doc("Repost Payment Ledger", docname)
+		repost_doc.check_permission("submit")
 		if repost_doc.docstatus.is_submitted() and repost_doc.repost_status in ["Queued", "Failed"]:
 			try:
 				for entry in repost_doc.repost_vouchers:
@@ -122,6 +123,8 @@ class RepostPaymentLedger(Document):
 def execute_repost_payment_ledger(docname):
 	"""Repost Payment Ledger Entries by background job."""
 
+	frappe.has_permission("Repost Payment Ledger", ptype="submit", doc=docname, throw=True)
+
 	job_name = "payment_ledger_repost_" + docname
 
 	frappe.enqueue(

erpnext/accounts/doctype/sales_invoice/sales_invoice.js

@@ -375,9 +375,10 @@ erpnext.accounts.SalesInvoiceController = class SalesInvoiceController extends (
 					get_query_filters: {
 						docstatus: 1,
 						status: ["not in", ["Closed", "On Hold"]],
-						per_billed: ["<", 99.99],
 						company: me.frm.doc.company,
 					},
+					get_query_method:
+						"erpnext.selling.doctype.sales_order.sales_order.get_potentially_billable_sales_orders",
 					allow_child_item_selection: true,
 					child_fieldname: "items",
 					child_columns: ["item_code", "item_name", "qty", "amount", "billed_amt"],

erpnext/accounts/doctype/sales_invoice/sales_invoice.json

@@ -597,6 +597,7 @@
   },
   {
    "collapsible": 1,
+   "collapsible_depends_on": "eval:doc.currency && doc.currency != erpnext.get_currency(doc.company)",
    "depends_on": "customer",
    "fieldname": "currency_and_price_list",
    "fieldtype": "Section Break",
@@ -2198,7 +2199,7 @@
    "link_fieldname": "consolidated_invoice"
   }
  ],
- "modified": "2026-04-06 22:30:28.513139",
+ "modified": "2026-08-12 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Sales Invoice",

erpnext/accounts/doctype/sales_invoice/sales_invoice.py

@@ -25,9 +25,9 @@ from erpnext.accounts.doctype.tax_withholding_category.tax_withholding_category
 from erpnext.accounts.general_ledger import get_round_off_account_and_cost_center
 from erpnext.accounts.party import (
 	CROSS_PARTY_FIELD_NO_MAP,
+	_get_party_details,
 	get_due_date,
 	get_party_account,
-	get_party_details,
 )
 from erpnext.accounts.utils import (
 	cancel_exchange_gain_loss_journal,
@@ -1637,7 +1637,7 @@ class SalesInvoice(SellingController):
 
 			for payment_mode in self.payments:
 				if skip_change_gl_entries and payment_mode.account == self.account_for_change_amount:
-					payment_mode.base_amount -= flt(self.change_amount)
+					payment_mode.base_amount -= flt(self.base_change_amount)
 
 				against_voucher = self.name
 				if self.is_return and self.return_against and not self.update_outstanding_for_self:
@@ -2266,9 +2266,9 @@ def make_delivery_note(source_name, target_doc=None):
 					"cost_center": "cost_center",
 				},
 				"postprocess": update_item,
-				"condition": lambda doc: doc.delivered_by_supplier != 1
-				and not doc.dn_detail
-				and doc.qty - doc.delivered_qty > 0,
+				"condition": lambda doc: (
+					doc.delivered_by_supplier != 1 and not doc.dn_detail and doc.qty - doc.delivered_qty > 0
+				),
 			},
 			"Sales Taxes and Charges": {"doctype": "Sales Taxes and Charges", "reset_value": True},
 			"Sales Team": {
@@ -2590,9 +2590,28 @@ def make_inter_company_transaction(doctype, source_name, target_doc=None):
 
 @frappe.whitelist()
 def get_received_items(reference_name: str, doctype: str, reference_fieldname: str):
-	reference_field = "inter_company_invoice_reference"
-	if doctype == "Purchase Order":
-		reference_field = "inter_company_order_reference"
+	# The only two targets this resolves a reference field for. Stating them rejects a caller
+	# supplied doctype that would otherwise be filtered on a column it does not have.
+	reference_fields = {
+		"Purchase Invoice": ("inter_company_invoice_reference", "Sales Invoice", "sales_invoice_item"),
+		"Purchase Order": ("inter_company_order_reference", "Sales Order", "sales_order_item"),
+	}
+	if doctype not in reference_fields:
+		frappe.throw(_("Invalid doctype {0}").format(doctype), frappe.PermissionError)
+
+	reference_field, source_doctype, expected_fieldname = reference_fields[doctype]
+
+	# the source document decides access, not the targets: those belong to the counterpart company
+	# and the caller legitimately may not read them. doc= for User Permissions.
+	frappe.has_permission(source_doctype, doc=reference_name, throw=True)
+
+	# `reference_fieldname` becomes a selected column and the result key, so it has to be this
+	# target's own reference field: any other item-table column would be returned from unauthorised rows.
+	if reference_fieldname != expected_fieldname:
+		frappe.throw(
+			_("{0} is not a valid reference field for {1}").format(reference_fieldname, doctype),
+			frappe.ValidationError,
+		)
 
 	filters = {
 		reference_field: reference_name,
@@ -2737,7 +2756,7 @@ def update_taxes(
 	master_doctype=None,
 ):
 	# Update Party Details
-	party_details = get_party_details(
+	party_details = _get_party_details(
 		party=party,
 		party_type=party_type,
 		company=company,

erpnext/accounts/doctype/sales_invoice/test_sales_invoice.py

@@ -47,7 +47,7 @@ from erpnext.stock.doctype.stock_reconciliation.test_stock_reconciliation import
 	create_stock_reconciliation,
 )
 from erpnext.stock.get_item_details import get_item_tax_map
-from erpnext.stock.utils import get_incoming_rate, get_stock_balance
+from erpnext.stock.utils import _get_incoming_rate, get_stock_balance
 
 
 class TestSalesInvoice(FrappeTestCase):
@@ -1235,6 +1235,33 @@ class TestSalesInvoice(FrappeTestCase):
 
 		frappe.db.set_single_value("Accounts Settings", "post_change_gl_entries", 1)
 
+	def test_pos_change_amount_multi_currency_gl_entry(self):
+		frappe.db.set_single_value("Accounts Settings", "post_change_gl_entries", 0)
+
+		si = create_sales_invoice(do_not_save=True)
+		si.is_pos = 1
+		si.currency = "USD"
+		si.conversion_rate = 50
+		si.party_account_currency = "USD"
+		si.account_for_change_amount = "Cash - _TC"
+		si.change_amount = 50
+		si.base_change_amount = 2500
+		si.append(
+			"payments",
+			{"mode_of_payment": "Cash", "account": "Cash - _TC", "amount": 150, "base_amount": 7500},
+		)
+
+		gl_entries = []
+		si.make_pos_gl_entries(gl_entries)
+
+		debtors_entry = next(entry for entry in gl_entries if entry["account"] == si.debit_to)
+		cash_entry = next(entry for entry in gl_entries if entry["account"] == "Cash - _TC")
+
+		self.assertEqual(flt(debtors_entry["credit"]), 5000.0)
+		self.assertEqual(flt(cash_entry["debit"]), 5000.0)
+
+		frappe.db.set_single_value("Accounts Settings", "post_change_gl_entries", 1)
+
 	def validate_pos_gl_entry(self, si, pos, cash_amount, validate_without_change_gle=False):
 		if validate_without_change_gle:
 			cash_amount -= pos.change_amount
@@ -2916,7 +2943,7 @@ class TestSalesInvoice(FrappeTestCase):
 
 		rate = 0.0
 		for d in si.get("items"):
-			rate = get_incoming_rate(
+			rate = _get_incoming_rate(
 				{
 					"item_code": d.item_code,
 					"warehouse": d.warehouse,

erpnext/accounts/doctype/sales_taxes_and_charges/sales_taxes_and_charges.json

@@ -21,10 +21,12 @@
   "rate",
   "section_break_9",
   "account_currency",
+  "net_amount",
   "tax_amount",
   "total",
   "tax_amount_after_discount_amount",
   "column_break_13",
+  "base_net_amount",
   "base_tax_amount",
   "base_total",
   "base_tax_amount_after_discount_amount",
@@ -190,11 +192,11 @@
    "fieldtype": "Column Break"
   },
   {
-    "allow_on_submit": 1,
-    "fieldname": "project",
-    "fieldtype": "Link",
-    "label": "Project",
-    "options": "Project"
+   "allow_on_submit": 1,
+   "fieldname": "project",
+   "fieldtype": "Link",
+   "label": "Project",
+   "options": "Project"
   },
   {
    "default": "0",
@@ -220,19 +222,36 @@
    "label": "Account Currency",
    "options": "Currency",
    "read_only": 1
+  },
+  {
+   "description": "Basis for tax calculation",
+   "fieldname": "net_amount",
+   "fieldtype": "Currency",
+   "label": "Net Amount",
+   "options": "currency",
+   "read_only": 1
+  },
+  {
+   "description": "Basis for tax calculation",
+   "fieldname": "base_net_amount",
+   "fieldtype": "Currency",
+   "label": "Net Amount (Company Currency)",
+   "options": "Company:company:default_currency",
+   "read_only": 1
   }
  ],
  "idx": 1,
  "index_web_pages_for_search": 1,
  "istable": 1,
  "links": [],
- "modified": "2024-01-14 10:08:17.776528",
+ "modified": "2026-05-01 00:37:57.880071",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Sales Taxes and Charges",
  "owner": "Administrator",
  "permissions": [],
+ "row_format": "Dynamic",
  "sort_field": "modified",
  "sort_order": "ASC",
  "states": []
-}
+}

erpnext/accounts/doctype/sales_taxes_and_charges/sales_taxes_and_charges.py

@@ -16,6 +16,7 @@ class SalesTaxesandCharges(Document):
 
 		account_currency: DF.Link | None
 		account_head: DF.Link
+		base_net_amount: DF.Currency
 		base_tax_amount: DF.Currency
 		base_tax_amount_after_discount_amount: DF.Currency
 		base_total: DF.Currency
@@ -33,9 +34,11 @@ class SalesTaxesandCharges(Document):
 		included_in_paid_amount: DF.Check
 		included_in_print_rate: DF.Check
 		item_wise_tax_detail: DF.Code | None
+		net_amount: DF.Currency
 		parent: DF.Data
 		parentfield: DF.Data
 		parenttype: DF.Data
+		project: DF.Link | None
 		rate: DF.Float
 		row_id: DF.Data | None
 		tax_amount: DF.Currency

erpnext/accounts/doctype/sales_taxes_and_charges_template/sales_taxes_and_charges_template.json

@@ -79,7 +79,7 @@
  "icon": "fa fa-money",
  "idx": 1,
  "links": [],
- "modified": "2024-01-30 13:07:28.801104",
+ "modified": "2026-09-16 12:00:00.000000",
  "modified_by": "Administrator",
  "module": "Accounts",
  "name": "Sales Taxes and Charges Template",
@@ -113,6 +113,26 @@
    "role": "Sales Master Manager",
    "share": 1,
    "write": 1
+  },
+  {
+   "role": "Delivery Manager",
+   "select": 1
+  },
+  {
+   "role": "Delivery User",
+   "select": 1
+  },
+  {
+   "role": "Maintenance Manager",
+   "select": 1
+  },
+  {
+   "role": "Maintenance User",
+   "select": 1
+  },
+  {
+   "role": "Stock Manager",
+   "select": 1
   }
  ],
  "show_title_field_in_link": 1,

erpnext/accounts/doctype/sales_taxes_and_charges_template/sales_taxes_and_charges_template_dashboard.py

@@ -7,10 +7,9 @@ def get_data():
 		"non_standard_fieldnames": {
 			"Tax Rule": "sales_tax_template",
 			"Subscription": "sales_tax_template",
-			"Restaurant": "default_tax_template",
 		},
 		"transactions": [
 			{"label": _("Transactions"), "items": ["Sales Invoice", "Sales Order", "Delivery Note"]},
-			{"label": _("References"), "items": ["POS Profile", "Subscription", "Restaurant", "Tax Rule"]},
+			{"label": _("References"), "items": ["POS Profile", "Subscription", "Tax Rule"]},
 		],
 	}