fix: restrict jinja globals in process statement of accounts templates (backport #56458) (#57232)

fix: restrict jinja globals in process statement of accounts templates

(cherry picked from commit ecb6d48ec0)

Co-authored-by: Shllokkk <shllokosan23@gmail.com>

erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py

@@ -218,6 +218,7 @@ def build_forest(data):
 		for row in data:
 			account_name, parent_account, account_number, parent_account_number = row[0:4]
 			if account_number:
+				account_number = cstr(account_number).strip()
 				account_name = f"{account_number} - {account_name}"
 			if parent_account_number:
 				parent_account_number = cstr(parent_account_number).strip()

erpnext/accounts/doctype/dunning/dunning.js

@@ -169,23 +169,10 @@ frappe.ui.form.on("Dunning", {
 	},
 	get_dunning_letter_text: function (frm) {
 		if (frm.doc.dunning_type) {
-			frappe.call({
-				method: "erpnext.accounts.doctype.dunning.dunning.get_dunning_letter_text",
-				args: {
-					dunning_type: frm.doc.dunning_type,
-					language: frm.doc.language,
-					doc: frm.doc,
-				},
-				callback: function (r) {
-					if (r.message) {
-						frm.set_value("body_text", r.message.body_text);
-						frm.set_value("closing_text", r.message.closing_text);
-						frm.set_value("language", r.message.language);
-					} else {
-						frm.set_value("body_text", "");
-						frm.set_value("closing_text", "");
-					}
-				},
+			frm.call("get_dunning_letter_text").then((r) => {
+				if (!r.exc) {
+					frm.refresh_fields();
+				}
 			});
 		}
 	},

erpnext/accounts/doctype/dunning/dunning.py

@@ -163,6 +163,46 @@ class Dunning(AccountsController):
 			"Serial and Batch Bundle",
 		]
 
+	@frappe.whitelist()
+	def get_dunning_letter_text(self):
+		DOCTYPE = "Dunning Letter Text"
+		FIELDS = ["body_text", "closing_text", "language"]
+
+		if not self.dunning_type:
+			return
+
+		filters = {"parent": self.dunning_type, "is_default_language": 1}
+
+		if self.language:
+			filters.pop("is_default_language")
+			filters["language"] = self.language
+
+		letter_text = frappe.db.get_value(DOCTYPE, filters, FIELDS, as_dict=True)
+
+		if not letter_text:
+			msg = (
+				_("Dunning Letter for Dunning Type {0} in language '{1}' not found.").format(
+					frappe.bold(self.dunning_type), frappe.bold(self.language)
+				)
+				if self.language
+				else _("Dunning Letter for Dunning Type {0} not found.").format(
+					frappe.bold(self.dunning_type)
+				)
+			)
+			frappe.msgprint(msg, alert=True, indicator="yellow")
+
+		self.body_text = (
+			frappe.render_template(letter_text.body_text, self.as_dict(), restrict_globals=True)
+			if letter_text
+			else None
+		)
+		self.closing_text = (
+			frappe.render_template(letter_text.closing_text, self.as_dict(), restrict_globals=True)
+			if letter_text
+			else None
+		)
+		self.language = letter_text.language if letter_text else self.language
+
 
 def update_linked_dunnings(doc, previous_outstanding_amount):
 	if (
@@ -241,35 +281,3 @@ def get_linked_dunnings_as_per_state(sales_invoice, state):
 			& (overdue_payment.sales_invoice == sales_invoice)
 		)
 	).run(as_dict=True)
-
-
-@frappe.whitelist()
-def get_dunning_letter_text(dunning_type: str, doc: str | dict, language: str | None = None) -> dict:
-	DOCTYPE = "Dunning Letter Text"
-	FIELDS = ["body_text", "closing_text", "language"]
-
-	if isinstance(doc, str):
-		doc = json.loads(doc)
-
-	if not language:
-		language = doc.get("language")
-
-	letter_text = None
-	if language:
-		letter_text = frappe.db.get_value(
-			DOCTYPE, {"parent": dunning_type, "language": language}, FIELDS, as_dict=1
-		)
-
-	if not letter_text:
-		letter_text = frappe.db.get_value(
-			DOCTYPE, {"parent": dunning_type, "is_default_language": 1}, FIELDS, as_dict=1
-		)
-
-	if not letter_text:
-		return {}
-
-	return {
-		"body_text": frappe.render_template(letter_text.body_text, doc),
-		"closing_text": frappe.render_template(letter_text.closing_text, doc),
-		"language": letter_text.language,
-	}

erpnext/accounts/doctype/dunning_type/dunning_type.py

@@ -3,7 +3,10 @@
 
 
 import frappe
+from frappe import _
 from frappe.model.document import Document
+from frappe.utils import comma_and
+from frappe.utils.jinja import validate_template
 
 
 class DunningType(Document):
@@ -30,3 +33,134 @@ class DunningType(Document):
 	def autoname(self):
 		company_abbr = frappe.get_value("Company", self.company, "abbr")
 		self.name = f"{self.dunning_type} - {company_abbr}"
+
+	def validate(self):
+		self.validate_dunning_letter_text()
+		self.validate_income_account()
+		self.validate_cost_center()
+		self.set_default_dunning_type()
+
+	def validate_dunning_letter_text(self):
+		self.validate_languages()
+		self.validate_is_default_language()
+		self.validate_dunning_letter_text_templates()
+
+	def validate_income_account(self):
+		if not self.income_account:
+			return
+
+		account = frappe.get_cached_doc("Account", self.income_account)
+
+		msg = []
+		if account.company != self.company:
+			msg.append(
+				_(
+					"{0} doesn't belong to Company {1}. Please select an Income Account that belongs to Company {1}."
+				).format(frappe.bold(self.income_account), frappe.bold(self.company))
+			)
+
+		if account.disabled:
+			msg.append(
+				_("{0} is disabled. Please select a valid Income Account.").format(
+					frappe.bold(self.income_account)
+				)
+			)
+
+		if account.root_type != "Income":
+			msg.append(
+				_("{0} is not an Income Account. Please select a valid Income Account.").format(
+					frappe.bold(self.income_account)
+				)
+			)
+
+		if account.is_group:
+			msg.append(
+				_("{0} is a group account. Please select a non-group Income Account.").format(
+					frappe.bold(self.income_account)
+				)
+			)
+
+		if msg:
+			frappe.msgprint(
+				msg,
+				title=_("Income Account Validation Error"),
+				as_list=True,
+				raise_exception=frappe.ValidationError,
+			)
+
+	def validate_cost_center(self):
+		if not self.cost_center:
+			return
+
+		cost_center = frappe.get_cached_doc("Cost Center", self.cost_center)
+
+		msg = []
+		if cost_center.company != self.company:
+			msg.append(
+				_(
+					"{0} doesn't belong to Company {1}. Please select a Cost Center that belongs to Company {1}."
+				).format(frappe.bold(self.cost_center), frappe.bold(self.company))
+			)
+
+		if cost_center.disabled:
+			msg.append(
+				_("{0} is disabled. Please select an enabled Cost Center.").format(
+					frappe.bold(self.cost_center)
+				)
+			)
+
+		if cost_center.is_group:
+			msg.append(
+				_("{0} is a group Cost Center. Please select a non-group Cost Center.").format(
+					frappe.bold(self.cost_center)
+				)
+			)
+
+		if msg:
+			frappe.msgprint(
+				msg,
+				title=_("Cost Center Validation Error"),
+				as_list=True,
+				raise_exception=frappe.ValidationError,
+			)
+
+	def validate_languages(self):
+		languages = [d.language for d in self.dunning_letter_text]
+
+		if len(languages) == len(set(languages)):
+			return
+
+		frappe.throw(_("Duplicate languages found on Dunning Letter Text. Keep only one of them."))
+
+	def validate_is_default_language(self):
+		is_default_language_list = [
+			d.language for d in self.dunning_letter_text if d.is_default_language == 1
+		]
+
+		if len(is_default_language_list) <= 1:
+			return
+
+		frappe.throw(
+			_("{0} languages are marked as default languages. Please select only one of them.").format(
+				comma_and(is_default_language_list, add_quotes=True)
+			)
+		)
+
+	def validate_dunning_letter_text_templates(self):
+		for d in self.dunning_letter_text:
+			if d.body_text:
+				validate_template(d.body_text, restrict_globals=True)
+
+			if d.closing_text:
+				validate_template(d.closing_text, restrict_globals=True)
+
+	def set_default_dunning_type(self):
+		if self.is_default != 1:
+			return
+
+		frappe.db.set_value(
+			"Dunning Type",
+			{"company": self.company, "is_default": 1, "name": ["!=", self.name]},
+			"is_default",
+			0,
+		)

erpnext/accounts/doctype/dunning_type/test_dunning_type.py

@@ -1,10 +1,200 @@
 # Copyright (c) 2020, Frappe Technologies Pvt. Ltd. and Contributors
 # See license.txt
-# import frappe
-import unittest
+
+import frappe
 
 from erpnext.tests.utils import ERPNextTestSuite
 
 
+def make_dunning_type(dunning_type, company="_Test Company", **kwargs):
+	doc = frappe.new_doc("Dunning Type")
+	doc.dunning_type = dunning_type
+	doc.company = company
+	doc.dunning_fee = kwargs.get("dunning_fee", 100)
+	doc.rate_of_interest = kwargs.get("rate_of_interest", 5)
+	doc.is_default = kwargs.get("is_default", 0)
+
+	if "income_account" in kwargs:
+		doc.income_account = kwargs["income_account"]
+	elif kwargs.get("income_account") is not False:
+		doc.income_account = "Sales - _TC" if company == "_Test Company" else "Sales - _TC1"
+
+	if "cost_center" in kwargs:
+		doc.cost_center = kwargs["cost_center"]
+	elif kwargs.get("cost_center") is not False:
+		doc.cost_center = "Main - _TC" if company == "_Test Company" else "Main - _TC1"
+
+	for row in kwargs.get("dunning_letter_text", [{"language": "en", "body_text": "Test body"}]):
+		doc.append("dunning_letter_text", row)
+
+	return doc
+
+
 class TestDunningType(ERPNextTestSuite):
-	pass
+	def test_income_account_must_belong_to_company(self):
+		doc = make_dunning_type("_Test Dunning Wrong Company Account", income_account="Sales - _TC1")
+		self.assertRaisesRegex(frappe.ValidationError, "doesn't belong to Company", doc.insert)
+
+	def test_income_account_must_not_be_disabled(self):
+		disabled_account = frappe.get_doc(
+			{
+				"doctype": "Account",
+				"account_name": "_Test Disabled Income Account",
+				"parent_account": "Direct Income - _TC",
+				"company": "_Test Company",
+				"account_type": "Income Account",
+				"disabled": 1,
+			}
+		).insert()
+
+		doc = make_dunning_type("_Test Dunning Disabled Account", income_account=disabled_account.name)
+		self.assertRaisesRegex(frappe.ValidationError, "is disabled", doc.insert)
+
+	def test_income_account_must_be_income_type(self):
+		doc = make_dunning_type("_Test Dunning Non Income Account", income_account="Debtors - _TC")
+		self.assertRaisesRegex(frappe.ValidationError, "is not an Income Account", doc.insert)
+
+	def test_income_account_must_not_be_group(self):
+		doc = make_dunning_type("_Test Dunning Group Account", income_account="Income - _TC")
+		self.assertRaisesRegex(frappe.ValidationError, "is a group account", doc.insert)
+
+	def test_income_account_is_optional(self):
+		doc = make_dunning_type("_Test Dunning No Income Account", income_account=False)
+		doc.insert()
+		self.assertFalse(doc.income_account)
+
+	def test_valid_income_account_passes(self):
+		doc = make_dunning_type("_Test Dunning Valid Income Account", income_account="Sales - _TC")
+		doc.insert()
+		self.assertEqual(doc.income_account, "Sales - _TC")
+
+	def test_cost_center_must_belong_to_company(self):
+		doc = make_dunning_type("_Test Dunning Wrong Company CC", cost_center="Main - _TC1")
+		self.assertRaisesRegex(frappe.ValidationError, "doesn't belong to Company", doc.insert)
+
+	def test_cost_center_must_not_be_disabled(self):
+		disabled_cc = frappe.get_doc(
+			{
+				"doctype": "Cost Center",
+				"cost_center_name": "_Test Disabled Cost Center",
+				"parent_cost_center": "_Test Company - _TC",
+				"company": "_Test Company",
+				"disabled": 1,
+			}
+		).insert()
+
+		doc = make_dunning_type("_Test Dunning Disabled CC", cost_center=disabled_cc.name)
+		self.assertRaisesRegex(frappe.ValidationError, "is disabled", doc.insert)
+
+	def test_cost_center_must_not_be_group(self):
+		doc = make_dunning_type("_Test Dunning Group CC", cost_center="_Test Company - _TC")
+		self.assertRaisesRegex(frappe.ValidationError, "is a group Cost Center", doc.insert)
+
+	def test_cost_center_is_optional(self):
+		doc = make_dunning_type("_Test Dunning No CC", cost_center=False)
+		doc.insert()
+		self.assertFalse(doc.cost_center)
+
+	def test_valid_cost_center_passes(self):
+		doc = make_dunning_type("_Test Dunning Valid CC", cost_center="Main - _TC")
+		doc.insert()
+		self.assertEqual(doc.cost_center, "Main - _TC")
+
+	def test_duplicate_languages_not_allowed(self):
+		doc = make_dunning_type(
+			"_Test Dunning Duplicate Language",
+			dunning_letter_text=[
+				{"language": "en", "body_text": "Body one"},
+				{"language": "en", "body_text": "Body two"},
+			],
+		)
+		self.assertRaisesRegex(frappe.ValidationError, "Duplicate languages found", doc.insert)
+
+	def test_unique_languages_allowed(self):
+		doc = make_dunning_type(
+			"_Test Dunning Unique Languages",
+			dunning_letter_text=[
+				{"language": "en", "body_text": "Body one"},
+				{"language": "de", "body_text": "Body two"},
+			],
+		)
+		doc.insert()
+		self.assertEqual(len(doc.dunning_letter_text), 2)
+
+	def test_only_one_default_language_allowed(self):
+		doc = make_dunning_type(
+			"_Test Dunning Multiple Default Language",
+			dunning_letter_text=[
+				{"language": "en", "body_text": "Body one", "is_default_language": 1},
+				{"language": "de", "body_text": "Body two", "is_default_language": 1},
+			],
+		)
+		self.assertRaisesRegex(
+			frappe.ValidationError, "languages are marked as default languages", doc.insert
+		)
+
+	def test_single_default_language_allowed(self):
+		doc = make_dunning_type(
+			"_Test Dunning Single Default Language",
+			dunning_letter_text=[
+				{"language": "en", "body_text": "Body one", "is_default_language": 1},
+				{"language": "de", "body_text": "Body two", "is_default_language": 0},
+			],
+		)
+		doc.insert()
+		self.assertEqual(doc.dunning_letter_text[0].is_default_language, 1)
+
+	def test_invalid_jinja_template_in_body_text_raises(self):
+		doc = make_dunning_type(
+			"_Test Dunning Invalid Body Template",
+			dunning_letter_text=[{"language": "en", "body_text": "{{ unclosed"}],
+		)
+		self.assertRaisesRegex(frappe.ValidationError, "Syntax error in template", doc.insert)
+
+	def test_invalid_jinja_template_in_closing_text_raises(self):
+		doc = make_dunning_type(
+			"_Test Dunning Invalid Closing Template",
+			dunning_letter_text=[
+				{"language": "en", "body_text": "Valid body", "closing_text": "{{ unclosed"}
+			],
+		)
+		self.assertRaisesRegex(frappe.ValidationError, "Syntax error in template", doc.insert)
+
+	def test_valid_jinja_template_passes(self):
+		doc = make_dunning_type(
+			"_Test Dunning Valid Template",
+			dunning_letter_text=[
+				{
+					"language": "en",
+					"body_text": "Outstanding amount is {{ outstanding_amount }}",
+					"closing_text": "Regards, {{ company }}",
+				}
+			],
+		)
+		doc.insert()
+		self.assertTrue(doc.name)
+
+	def test_set_default_dunning_type_unsets_previous_default(self):
+		first = make_dunning_type("_Test Dunning Default One", is_default=1)
+		first.insert()
+		self.assertEqual(frappe.db.get_value("Dunning Type", first.name, "is_default"), 1)
+
+		second = make_dunning_type("_Test Dunning Default Two", is_default=1)
+		second.insert()
+
+		self.assertEqual(frappe.db.get_value("Dunning Type", first.name, "is_default"), 0)
+		self.assertEqual(frappe.db.get_value("Dunning Type", second.name, "is_default"), 1)
+
+	def test_set_default_dunning_type_scoped_per_company(self):
+		company_1 = make_dunning_type("_Test Dunning Default Co1", is_default=1)
+		company_1.insert()
+
+		company_2 = make_dunning_type(
+			"_Test Dunning Default Co2",
+			company="_Test Company 1",
+			is_default=1,
+		)
+		company_2.insert()
+
+		self.assertEqual(frappe.db.get_value("Dunning Type", company_1.name, "is_default"), 1)
+		self.assertEqual(frappe.db.get_value("Dunning Type", company_2.name, "is_default"), 1)

erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py

@@ -99,9 +99,9 @@ class ProcessStatementOfAccounts(Document):
 		if not self.pdf_name:
 			self.pdf_name = "{{ customer.customer_name }}"
 
-		validate_template(self.subject)
-		validate_template(self.body)
-		validate_template(self.pdf_name)
+		validate_template(self.subject, restrict_globals=True)
+		validate_template(self.body, restrict_globals=True)
+		validate_template(self.pdf_name, restrict_globals=True)
 
 		if not self.customers:
 			frappe.throw(_("Customers not selected."))
@@ -527,15 +527,15 @@ def send_emails(document_name, from_scheduler=False, posting_date=None):
 	if report:
 		for customer, report_pdf in report.items():
 			context = get_context(customer, doc)
-			filename = frappe.render_template(doc.pdf_name, context)
+			filename = frappe.render_template(doc.pdf_name, context, restrict_globals=True)
 			attachments = [{"fname": filename + ".pdf", "fcontent": report_pdf}]
 
 			recipients, cc = get_recipients_and_cc(customer, doc)
 			if not recipients:
 				continue
 
-			subject = frappe.render_template(doc.subject, context)
-			message = frappe.render_template(doc.body, context)
+			subject = frappe.render_template(doc.subject, context, restrict_globals=True)
+			message = frappe.render_template(doc.body, context, restrict_globals=True)
 
 			if doc.sender:
 				sender_email = frappe.db.get_value("Email Account", doc.sender, "email_id")

erpnext/accounts/doctype/sales_invoice/sales_invoice.py

@@ -3156,8 +3156,6 @@ def create_dunning(source_name, target_doc=None, ignore_permissions=False):
 	from frappe.model.mapper import get_mapped_doc
 
 	def postprocess_dunning(source, target):
-		from erpnext.accounts.doctype.dunning.dunning import get_dunning_letter_text
-
 		dunning_type = frappe.db.exists("Dunning Type", {"is_default": 1, "company": source.company})
 		if dunning_type:
 			dunning_type = frappe.get_doc("Dunning Type", dunning_type)
@@ -3166,14 +3164,8 @@ def create_dunning(source_name, target_doc=None, ignore_permissions=False):
 			target.dunning_fee = dunning_type.dunning_fee
 			target.income_account = dunning_type.income_account
 			target.cost_center = dunning_type.cost_center
-			letter_text = get_dunning_letter_text(
-				dunning_type=dunning_type.name, doc=target.as_dict(), language=source.language
-			)
-
-			if letter_text:
-				target.body_text = letter_text.get("body_text")
-				target.closing_text = letter_text.get("closing_text")
-				target.language = letter_text.get("language")
+			target.language = source.language
+			target.get_dunning_letter_text()
 
 		# update outstanding from doc
 		if source.payment_schedule and len(source.payment_schedule) == 1:

erpnext/buying/doctype/purchase_order_item/purchase_order_item.json

@@ -923,8 +923,10 @@
    "fieldname": "job_card",
    "fieldtype": "Link",
    "label": "Job Card",
+   "no_copy": 1,
    "options": "Job Card",
-   "search_index": 1
+   "print_hide": 1,
+   "read_only": 1
   },
   {
    "fieldname": "distributed_discount_amount",
@@ -951,7 +953,7 @@
  "index_web_pages_for_search": 1,
  "istable": 1,
  "links": [],
- "modified": "2026-05-14 12:16:16.192936",
+ "modified": "2026-07-15 10:30:04.600510",
  "modified_by": "Administrator",
  "module": "Buying",
  "name": "Purchase Order Item",

erpnext/buying/doctype/supplier/supplier.py

@@ -16,7 +16,10 @@ from erpnext.accounts.party import (
 	validate_party_accounts,
 	validate_party_currency_before_merging,
 )
-from erpnext.controllers.website_list_for_contact import add_role_for_portal_user
+from erpnext.controllers.website_list_for_contact import (
+	add_role_for_portal_user,
+	link_portal_users_to_contacts,
+)
 from erpnext.utilities.transaction_base import TransactionBase
 
 
@@ -109,6 +112,7 @@ class Supplier(TransactionBase):
 	def on_update(self):
 		self.create_primary_contact()
 		self.create_primary_address()
+		link_portal_users_to_contacts(self)
 
 	def add_role_for_user(self):
 		for portal_user in self.portal_users:

erpnext/buying/doctype/supplier/test_supplier.py

@@ -203,3 +203,24 @@ class TestSupplierPortal(ERPNextTestSuite):
 			_, suppliers = get_customers_suppliers("Purchase Order", user)
 
 			self.assertIn(supplier.name, suppliers)
+
+	def test_portal_user_contact_link(self):
+		user_email = frappe.generate_hash() + "@example.com"
+		user = frappe.new_doc("User")
+		user.email = user_email
+		user.first_name = "Test Portal Contact User"
+		user.send_welcome_email = False
+		user.insert(ignore_permissions=True)
+
+		contact = frappe.new_doc("Contact")
+		contact.first_name = "Test Portal Contact User"
+		contact.add_email(user_email, is_primary=1)
+		contact.links = []
+		contact.insert(ignore_permissions=True)
+
+		supplier = create_supplier()
+		supplier.append("portal_users", {"user": user.name})
+		supplier.save()
+
+		contact.reload()
+		self.assertTrue(contact.has_link("Supplier", supplier.name))

erpnext/buying/doctype/supplier_quotation_item/supplier_quotation_item.json

@@ -307,6 +307,7 @@
    "fieldname": "net_rate",
    "fieldtype": "Currency",
    "label": "Net Rate",
+   "options": "currency",
    "print_hide": 1,
    "read_only": 1
   },
@@ -613,7 +614,7 @@
  "index_web_pages_for_search": 1,
  "istable": 1,
  "links": [],
- "modified": "2025-06-17 12:05:52.441645",
+ "modified": "2026-07-15 10:33:24.855979",
  "modified_by": "Administrator",
  "module": "Buying",
  "name": "Supplier Quotation Item",

erpnext/controllers/stock_controller.py

@@ -1347,66 +1347,63 @@ class StockController(AccountsController):
 		if not batches:
 			return
 
-		field_mapper = {
-			"Sales Invoice": [["Sales Order", "sales_order"]],
-			"Delivery Note": [["Sales Order", "against_sales_order"]],
-			"Stock Entry": [
-				["Work Order", "work_order"],
-				["Subcontracting Inward Order", "subcontracting_inward_order"],
-			],
+		reference_fields = {
+			"Sales Invoice": ["sales_order"],
+			"Delivery Note": ["against_sales_order"],
+			"Stock Entry": ["work_order", "subcontracting_inward_order"],
 		}.get(self.doctype)
 
-		qty_field = {
-			"Sales Invoice": "qty",
-			"Delivery Note": "qty",
-			"Stock Entry": "fg_completed_qty",
-		}.get(self.doctype)
-
-		reserved_batches_data = self.get_reserved_batches(batches)
 		items = self.items
 		if self.doctype == "Stock Entry":
 			items = [self]
 
-		for item in items:
-			for field in field_mapper:
-				if not item.get(field[1]):
-					continue
+		own_vouchers = {item.get(field) for item in items for field in reference_fields if item.get(field)}
 
-				value = item.get(field[1])
-				for row in reserved_batches_data:
-					if self.doctype in ["Sales Invoice", "Delivery Note"] and row.item_code != item.get(
-						"item_code"
-					):
-						continue
+		outstanding_qty = defaultdict(float)
+		reservations = defaultdict(list)
+		for row in self.get_reserved_batches(batches):
+			if row.voucher_no in own_vouchers:
+				continue
 
-					if row.voucher_no == value:
-						continue
+			key = (row.batch_no, row.warehouse)
+			outstanding = flt(row.qty) - flt(row.delivered_qty)
+			outstanding_qty[key] += outstanding
+			if outstanding > 0:
+				reservations[key].append(row)
 
-					batch_qty = get_batch_qty(
-						row.batch_no,
-						row.warehouse,
-						posting_date=self.posting_date,
-						posting_time=self.posting_time,
-						consider_negative_batches=True,
-					)
+		for (batch_no, warehouse), reserved_qty in outstanding_qty.items():
+			if flt(reserved_qty, 6) <= 0:
+				continue
 
-					if item.get(qty_field) < batch_qty:
-						continue
+			batch_qty = get_batch_qty(
+				batch_no,
+				warehouse,
+				posting_date=self.posting_date,
+				posting_time=self.posting_time,
+				consider_negative_batches=True,
+			)
 
-					frappe.throw(
-						_(
-							"The batch {0} is already reserved in {1} {2}. So, cannot proceed with the {3} {4}, which is created against the {5} {6}."
-						).format(
-							frappe.bold(row.batch_no),
-							frappe.bold(row.voucher_type),
-							frappe.bold(row.voucher_no),
-							frappe.bold(self.doctype),
-							frappe.bold(self.name),
-							frappe.bold(field[0]),
-							frappe.bold(value),
-						),
-						title=_("Reserved Batch Conflict"),
-					)
+			if flt(batch_qty, 6) >= flt(reserved_qty, 6):
+				continue
+
+			vouchers = ", ".join(
+				f"{frappe.bold(voucher_type)} {frappe.bold(voucher_no)}"
+				for voucher_type, voucher_no in dict.fromkeys(
+					(row.voucher_type, row.voucher_no) for row in reservations[(batch_no, warehouse)]
+				)
+			)
+			frappe.throw(
+				_(
+					"The batch {0} is reserved for {1} in the warehouse {2} and the remaining quantity is not enough to cover the reservations. So, cannot proceed with the {3} {4}."
+				).format(
+					frappe.bold(batch_no),
+					vouchers,
+					frappe.bold(warehouse),
+					frappe.bold(self.doctype),
+					frappe.bold(self.name),
+				),
+				title=_("Reserved Batch Conflict"),
+			)
 
 	def get_reserved_batches(self, batches):
 		doctype = frappe.qb.DocType("Stock Reservation Entry")
@@ -1418,9 +1415,10 @@ class StockController(AccountsController):
 			.on(doctype.name == child_doc.parent)
 			.select(
 				child_doc.batch_no,
+				child_doc.qty,
+				child_doc.delivered_qty,
 				doctype.voucher_type,
 				doctype.voucher_no,
-				doctype.item_code,
 				doctype.warehouse,
 			)
 			.where((doctype.docstatus == 1) & (child_doc.batch_no.isin(batches)))
@@ -2057,7 +2055,7 @@ class StockController(AccountsController):
 
 
 @frappe.whitelist()
-def show_accounting_ledger_preview(company, doctype, docname):
+def show_accounting_ledger_preview(company: str, doctype: str, docname: str):
 	filters = frappe._dict(company=company, include_dimensions=1)
 	doc = frappe.get_lazy_doc(doctype, docname)
 	doc.check_permission("read")
@@ -2071,7 +2069,7 @@ def show_accounting_ledger_preview(company, doctype, docname):
 
 
 @frappe.whitelist()
-def show_stock_ledger_preview(company, doctype, docname):
+def show_stock_ledger_preview(company: str, doctype: str, docname: str):
 	filters = frappe._dict(company=company)
 	doc = frappe.get_lazy_doc(doctype, docname)
 	doc.check_permission("read")

erpnext/controllers/website_list_for_contact.py

@@ -7,6 +7,8 @@ import json
 import frappe
 from frappe import _
 from frappe.modules.utils import get_module_app
+from frappe.query_builder import Criterion
+from frappe.query_builder.functions import Lower
 from frappe.utils import cint, flt, has_common
 from frappe.utils.user import is_website_user
 
@@ -306,3 +308,63 @@ def add_role_for_portal_user(portal_user, role):
 
 	user_doc.add_roles(role)
 	frappe.msgprint(_("Added {1} Role to User {0}.").format(frappe.bold(user_doc.name), role), alert=True)
+
+
+def link_portal_users_to_contacts(doc):
+	"""When portal users are added to Supplier/Customer, link them to the Contact profile."""
+	# a User's name is its (lowercased) email, so portal_users are already the emails
+	portal_users = {p.user for p in doc.get("portal_users") or [] if p.user}
+	if not portal_users:
+		return
+
+	before = doc.get_doc_before_save()
+	if before:
+		previous_users = {p.user for p in before.get("portal_users") or [] if p.user}
+		if portal_users == previous_users:
+			return
+
+	portal_users = list(portal_users)
+
+	contact = frappe.qb.DocType("Contact")
+	contact_email = frappe.qb.DocType("Contact Email")
+
+	query = (
+		frappe.qb.from_(contact)
+		.left_join(contact_email)
+		.on(contact_email.parent == contact.name)
+		.select(contact.name)
+		.distinct()
+	)
+
+	conditions = [
+		contact.user.isin(portal_users),
+		Lower(contact.email_id).isin(portal_users),
+		Lower(contact_email.email_id).isin(portal_users),
+	]
+
+	query = query.where(Criterion.any(conditions))
+	contacts = query.run(pluck=True)
+
+	if not contacts:
+		return
+
+	dynamic_link = frappe.qb.DocType("Dynamic Link")
+	existing_links = (
+		frappe.qb.from_(dynamic_link)
+		.select(dynamic_link.parent)
+		.where(
+			(dynamic_link.parenttype == "Contact")
+			& (dynamic_link.parent.isin(contacts))
+			& (dynamic_link.link_doctype == doc.doctype)
+			& (dynamic_link.link_name == doc.name)
+		)
+		.run(pluck=True)
+	)
+
+	contacts_to_link = [name for name in contacts if name not in existing_links]
+
+	for name in contacts_to_link:
+		contact_doc = frappe.get_doc("Contact", name)
+		if not contact_doc.has_link(doc.doctype, doc.name):
+			contact_doc.append("links", {"link_doctype": doc.doctype, "link_name": doc.name})
+			contact_doc.save(ignore_permissions=True)

erpnext/manufacturing/doctype/production_plan/production_plan.js

@@ -445,8 +445,6 @@ frappe.ui.form.on("Production Plan", {
 			frappe.throw(__("Select the Warehouse"));
 		}
 
-		frm.set_value("consider_minimum_order_qty", 0);
-
 		if (!frm.doc.ignore_existing_ordered_qty) {
 			frm.events.get_items_for_material_requests(frm);
 		} else {

erpnext/manufacturing/doctype/production_plan/production_plan.py

@@ -1823,7 +1823,13 @@ def get_items_for_material_requests(doc, warehouses=None, get_parent_warehouse_d
 	if (ignore_existing_ordered_qty or get_parent_warehouse_data) and warehouses:
 		new_mr_items = []
 		for item in mr_items:
-			get_materials_from_other_locations(item, warehouses, new_mr_items, company)
+			get_materials_from_other_locations(
+				item,
+				warehouses,
+				new_mr_items,
+				company,
+				consider_minimum_order_qty=doc.get("consider_minimum_order_qty"),
+			)
 
 		mr_items = new_mr_items
 
@@ -1845,7 +1851,9 @@ def get_items_for_material_requests(doc, warehouses=None, get_parent_warehouse_d
 	return mr_items
 
 
-def get_materials_from_other_locations(item, warehouses, new_mr_items, company):
+def get_materials_from_other_locations(
+	item, warehouses, new_mr_items, company, consider_minimum_order_qty=False
+):
 	from erpnext.stock.doctype.pick_list.pick_list import get_available_item_locations
 
 	purchase_uom = frappe.db.get_value("Item", item.get("item_code"), "purchase_uom")
@@ -1888,7 +1896,8 @@ def get_materials_from_other_locations(item, warehouses, new_mr_items, company):
 
 	precision = frappe.get_precision("Material Request Plan Item", "quantity")
 	if flt(required_qty, precision) > 0:
-		required_qty = required_qty
+		if consider_minimum_order_qty:
+			required_qty = max(required_qty, flt(item.get("min_order_qty")))
 
 		if frappe.db.get_value("UOM", purchase_uom, "must_be_whole_number"):
 			required_qty = ceil(required_qty)

erpnext/manufacturing/doctype/production_plan/test_production_plan.py

@@ -2030,6 +2030,18 @@ class TestProductionPlan(ERPNextTestSuite):
 		for d in mr_items:
 			self.assertEqual(d.get("quantity"), 1000.0)
 
+		source_warehouse = create_warehouse("MOQ Source Warehouse", company="_Test Company")
+		make_stock_entry(item_code=rm_item, qty=7, rate=100, target=source_warehouse)
+
+		pln.ignore_existing_ordered_qty = 1
+		mr_items = get_items_for_material_requests(
+			pln.as_dict(), warehouses=[{"warehouse": source_warehouse}]
+		)
+		self.assertEqual(len(mr_items), 2)
+		items_by_type = {d.get("material_request_type"): d for d in mr_items}
+		self.assertEqual(items_by_type["Material Transfer"].get("quantity"), 7.0)
+		self.assertEqual(items_by_type["Purchase"].get("quantity"), 1000.0)
+
 	def test_fg_item_quantity(self):
 		fg_item = make_item(properties={"is_stock_item": 1}).name
 		rm_item = make_item(properties={"is_stock_item": 1}).name

erpnext/patches.txt

@@ -490,3 +490,4 @@ erpnext.patches.v15_0.backfill_sla_link_filters_on_custom_field
 erpnext.patches.v15_0.backfill_sla_link_filters_on_docfield
 erpnext.patches.v16_0.crm_settings_handle_allowed_users_for_frappe_crm
 erpnext.patches.v16_0.backfill_pick_list_transferred_qty
+erpnext.patches.v16_0.access_control_for_project_users

erpnext/patches/v16_0/access_control_for_project_users.py

@@ -0,0 +1,33 @@
+import frappe
+
+
+def execute():
+	Project = frappe.qb.DocType("Project")
+	ProjectUser = frappe.qb.DocType("Project User")
+
+	query = (
+		frappe.qb.from_(Project)
+		.join(ProjectUser)
+		.on(Project.name == ProjectUser.parent)
+		.select(Project.name, ProjectUser.user)
+	)
+
+	proj_users = query.run(as_dict=1)
+
+	project_mapped_users = get_project_mapped_users(proj_users)
+
+	for d in proj_users:
+		if d.user in project_mapped_users[d.name]:
+			continue
+
+		frappe.share.add_docshare("Project", d.name, user=d.user)
+
+
+def get_project_mapped_users(proj_users):
+	projects = set([d.name for d in proj_users])
+	project_mapped_users = {}
+
+	for d in projects:
+		project_mapped_users[d] = [d.user for d in frappe.share.get_users("Project", d)]
+
+	return project_mapped_users

erpnext/projects/doctype/project/project.json

@@ -86,7 +86,7 @@
    "no_copy": 1,
    "oldfieldname": "status",
    "oldfieldtype": "Select",
-   "options": "Open\nCompleted\nCancelled",
+   "options": "Open\nOn hold\nCompleted\nCancelled",
    "search_index": 1
   },
   {
@@ -210,13 +210,15 @@
    "fieldname": "users",
    "fieldtype": "Table",
    "label": "Users",
-   "options": "Project User"
+   "options": "Project User",
+   "permlevel": 1
   },
   {
    "fieldname": "copied_from",
    "fieldtype": "Data",
    "hidden": 1,
    "label": "Copied From",
+   "permlevel": 1,
    "read_only": 1
   },
   {
@@ -482,13 +484,25 @@
  "index_web_pages_for_search": 1,
  "links": [],
  "max_attachments": 4,
- "modified": "2026-05-22 16:45:50.762759",
+ "modified": "2026-07-14 14:32:11.328347",
  "modified_by": "Administrator",
  "module": "Projects",
  "name": "Project",
  "naming_rule": "By \"Naming Series\" field",
  "owner": "Administrator",
  "permissions": [
+  {
+   "delete": 1,
+   "email": 1,
+   "export": 1,
+   "permlevel": 1,
+   "print": 1,
+   "read": 1,
+   "report": 1,
+   "role": "Projects Manager",
+   "share": 1,
+   "write": 1
+  },
   {
    "create": 1,
    "delete": 1,

erpnext/projects/doctype/project/project.py

@@ -61,7 +61,7 @@ class Project(Document):
 		project_type: DF.Link | None
 		sales_order: DF.Link | None
 		second_email: DF.Time | None
-		status: DF.Literal["Open", "Completed", "Cancelled"]
+		status: DF.Literal["Open", "On hold", "Completed", "Cancelled"]
 		subject: DF.Data | None
 		to_time: DF.Time | None
 		total_billable_amount: DF.Currency
@@ -92,7 +92,8 @@ class Project(Document):
 
 	def validate(self):
 		if not self.is_new():
-			self.copy_from_template()  # nosemgrep
+			self.copy_from_template()
+			self.control_access_for_project_users()
 		self.send_welcome_email()
 		self.update_costing()
 		self.update_percent_complete()
@@ -205,6 +206,7 @@ class Project(Document):
 		self.copy_from_template()  # nosemgrep
 		if self.sales_order:
 			frappe.db.set_value("Sales Order", self.sales_order, "project", self.name)
+		self.control_access_for_project_users()
 
 	def on_trash(self):
 		frappe.db.set_value("Sales Order", {"project": self.name}, "project", "")
@@ -262,8 +264,8 @@ class Project(Document):
 					pct_complete += row["progress"] * frappe.utils.safe_div(row["task_weight"], weight_sum)
 				self.percent_complete = flt(flt(pct_complete), 2)
 
-		# don't update status if it is cancelled
-		if self.status == "Cancelled":
+		# don't update status if it is manually set to cancelled or on hold
+		if self.status in ("Cancelled", "On hold"):
 			return
 
 		self.status = "Completed" if self.percent_complete == 100 else "Open"
@@ -377,6 +379,34 @@ class Project(Document):
 					)
 					user.welcome_email_sent = 1
 
+	def control_access_for_project_users(self):
+		def revoke_access_for_project_users(removed_users):
+			users = set([d.user for d in frappe.share.get_users(self.doctype, self.name)])
+			for user in removed_users:
+				if user not in users:
+					continue
+
+				frappe.share.remove(self.doctype, self.name, user)
+
+		def grant_access_for_project_users(new_users):
+			for user in new_users:
+				frappe.share.add_docshare(self.doctype, self.name, user=user)
+
+		current_users = set([d.user for d in self.users])
+		old_doc = self.get_doc_before_save()
+
+		if not old_doc:
+			grant_access_for_project_users(current_users)
+			return
+
+		previous_users = set([d.user for d in old_doc.users])
+
+		new_users = current_users - previous_users
+		removed_users = previous_users - current_users
+
+		revoke_access_for_project_users(removed_users)
+		grant_access_for_project_users(new_users)
+
 
 def get_timeline_data(doctype: str, name: str) -> dict[int, int]:
 	"""Return timeline for attendance"""

erpnext/projects/doctype/project/project_list.js

@@ -4,6 +4,8 @@ frappe.listview_settings["Project"] = {
 	get_indicator: function (doc) {
 		if (doc.status == "Open" && doc.percent_complete) {
 			return [__("{0}%", [cint(doc.percent_complete)]), "orange", "percent_complete,>,0|status,=,Open"];
+		} else if (doc.status == "On hold") {
+			return [__("On hold"), "blue", "status,=,On hold"];
 		} else {
 			return [__(doc.status), frappe.utils.guess_colour(doc.status), "status,=," + doc.status];
 		}

erpnext/projects/doctype/project/test_project.py

@@ -244,6 +244,61 @@ class TestProject(ERPNextTestSuite):
 		project.save()
 		self.assertEqual(project.status, "Completed")
 
+	def _create_portal_user(self, email):
+		"""A user with no Project-related role, so read access can only come from
+		control_access_for_project_users() sharing the doc with them."""
+		if not frappe.db.exists("User", email):
+			frappe.get_doc(
+				{
+					"doctype": "User",
+					"email": email,
+					"first_name": "Portal",
+					"send_welcome_email": 0,
+				}
+			).insert(ignore_permissions=True)
+		return email
+
+	def test_new_project_grants_access_to_its_users(self):
+		member = self._create_portal_user(f"new_proj_member_{frappe.generate_hash(length=6)}@example.com")
+
+		project = frappe.get_doc(
+			doctype="Project",
+			project_name=f"_Test New Project Access {frappe.generate_hash(length=6)}",
+			status="Open",
+			company="_Test Company",
+		)
+		project.append("users", {"user": member, "welcome_email_sent": 1})
+		project.insert()  # must not raise
+
+		self.assertTrue(project.has_permission(user=member))
+		shared_with = [d.user for d in frappe.share.get_users("Project", project.name)]
+		self.assertIn(member, shared_with)
+
+	def test_adding_and_removing_project_user_updates_access(self):
+		stays = self._create_portal_user(f"stays_{frappe.generate_hash(length=6)}@example.com")
+		leaves = self._create_portal_user(f"leaves_{frappe.generate_hash(length=6)}@example.com")
+
+		project = frappe.get_doc(
+			doctype="Project",
+			project_name=f"_Test Project User Membership {frappe.generate_hash(length=6)}",
+			status="Open",
+			company="_Test Company",
+		)
+		project.append("users", {"user": stays, "welcome_email_sent": 1})
+		project.insert()
+		self.assertTrue(project.has_permission(user=stays))
+
+		# adding a user on update (not insert) must also grant them access
+		project.append("users", {"user": leaves, "welcome_email_sent": 1})
+		project.save()
+		self.assertTrue(project.has_permission(user=leaves))
+
+		# removing a user must revoke the share that was granted for membership
+		project.users = [d for d in project.users if d.user != leaves]
+		project.save()
+		self.assertFalse(project.has_permission(user=leaves))
+		self.assertTrue(project.has_permission(user=stays))
+
 
 def get_project(name, template):
 	project = frappe.get_doc(

erpnext/selling/doctype/customer/customer.py

@@ -24,7 +24,10 @@ from erpnext.accounts.party import (
 	validate_party_accounts,
 	validate_party_currency_before_merging,
 )
-from erpnext.controllers.website_list_for_contact import add_role_for_portal_user
+from erpnext.controllers.website_list_for_contact import (
+	add_role_for_portal_user,
+	link_portal_users_to_contacts,
+)
 from erpnext.utilities.transaction_base import TransactionBase
 
 
@@ -273,6 +276,8 @@ class Customer(TransactionBase):
 
 		self.update_customer_groups()
 
+		link_portal_users_to_contacts(self)
+
 	def add_role_for_user(self):
 		for portal_user in self.portal_users:
 			add_role_for_portal_user(portal_user, "Customer")

erpnext/selling/doctype/customer/test_customer.py

@@ -398,6 +398,33 @@ class TestCustomer(ERPNextTestSuite):
 		self.assertEqual(middle, "Michael")
 		self.assertEqual(last, "Doe")
 
+	def test_portal_user_contact_link(self):
+		user_email = frappe.generate_hash() + "@example.com"
+		user = frappe.new_doc("User")
+		user.email = user_email
+		user.first_name = "Test Portal Customer User"
+		user.send_welcome_email = False
+		user.insert(ignore_permissions=True)
+
+		contact = frappe.new_doc("Contact")
+		contact.first_name = "Test Portal Customer User"
+		contact.add_email(user_email, is_primary=1)
+		contact.links = []
+		contact.insert(ignore_permissions=True)
+
+		customer = frappe.get_doc(
+			{
+				"doctype": "Customer",
+				"customer_name": "Test Portal Contact Customer",
+				"customer_type": "Individual",
+			}
+		)
+		customer.append("portal_users", {"user": user.name})
+		customer.insert()
+
+		contact.reload()
+		self.assertTrue(contact.has_link("Customer", customer.name))
+
 
 def get_customer_dict(customer_name):
 	return {

erpnext/stock/doctype/stock_reservation_entry/test_stock_reservation_entry.py

@@ -697,6 +697,66 @@ class TestStockReservationEntry(ERPNextTestSuite):
 		# Test - 1: ValidationError should be thrown as the inwarded stock is reserved.
 		self.assertRaises(frappe.ValidationError, se.cancel)
 
+	@ERPNextTestSuite.change_settings(
+		"Stock Settings",
+		{
+			"allow_negative_stock": 0,
+			"enable_stock_reservation": 1,
+			"auto_reserve_serial_and_batch": 1,
+			"pick_serial_and_batch_based_on": "FIFO",
+			"use_serial_batch_fields": 1,
+		},
+	)
+	def test_batch_shared_across_sales_orders_can_be_delivered(self) -> None:
+		# Regression (#57159): one batch reserved by two Sales Orders. Delivering each order's own
+		# reserved unit must not raise Reserved Batch Conflict — the remainder covers the other order.
+		# The batch is set on the row explicitly as the v16 reserved-stock mapper does not carry
+		# the reserved batch onto the Delivery Note row.
+		item_doc = make_batch_item()
+		create_material_receipt(items={item_doc.name: item_doc}, warehouse=self.warehouse, qty=2)
+
+		orders = []
+		for _i in range(2):
+			so = make_sales_order(item_code=item_doc.name, warehouse=self.warehouse, qty=1, rate=100)
+			so.create_stock_reservation_entries()
+			orders.append(so)
+
+		(batch_no,) = get_reserved_batch_nos(orders[0].name) | get_reserved_batch_nos(orders[1].name)
+
+		for so in orders:
+			dn = make_delivery_note(so.name)
+			dn.items[0].batch_no = batch_no
+			dn.save()
+			dn.submit()
+			self.assertEqual(dn.docstatus, 1)
+
+	@ERPNextTestSuite.change_settings(
+		"Stock Settings",
+		{
+			"allow_negative_stock": 0,
+			"enable_stock_reservation": 1,
+			"auto_reserve_serial_and_batch": 1,
+			"pick_serial_and_batch_based_on": "FIFO",
+			"use_serial_batch_fields": 1,
+		},
+	)
+	def test_delivery_draining_a_batch_reserved_for_another_sales_order_is_blocked(self) -> None:
+		# Guard for #57159 fix: an order without a reservation must still be blocked from draining
+		# a batch below what another order has reserved from it, even if other batches have stock.
+		item_doc = make_batch_item()
+		create_material_receipt(items={item_doc.name: item_doc}, warehouse=self.warehouse, qty=2)
+		create_material_receipt(items={item_doc.name: item_doc}, warehouse=self.warehouse, qty=2)
+
+		so_a = make_sales_order(item_code=item_doc.name, warehouse=self.warehouse, qty=2, rate=100)
+		so_a.create_stock_reservation_entries()
+		(reserved_batch_no,) = get_reserved_batch_nos(so_a.name)
+
+		so_b = make_sales_order(item_code=item_doc.name, warehouse=self.warehouse, qty=2, rate=100)
+		dn = make_delivery_note(so_b.name)
+		dn.items[0].batch_no = reserved_batch_no
+		dn.save()
+		self.assertRaisesRegex(frappe.ValidationError, "is reserved for", dn.submit)
+
 
 def create_items() -> dict:
 	items_properties = [
@@ -737,6 +797,33 @@ def create_items() -> dict:
 	return items
 
 
+def make_batch_item():
+	return make_item(
+		properties={
+			"is_stock_item": 1,
+			"valuation_rate": 100,
+			"has_batch_no": 1,
+			"create_new_batch": 1,
+			"batch_number_series": "SRBI-.#####.",
+		}
+	)
+
+
+def get_reserved_batch_nos(sales_order: str) -> set:
+	sre = frappe.qb.DocType("Stock Reservation Entry")
+	sb_entry = frappe.qb.DocType("Serial and Batch Entry")
+
+	batch_nos = (
+		frappe.qb.from_(sre)
+		.inner_join(sb_entry)
+		.on(sre.name == sb_entry.parent)
+		.select(sb_entry.batch_no)
+		.where((sre.voucher_no == sales_order) & (sre.docstatus == 1))
+	).run(pluck=True)
+
+	return set(batch_nos)
+
+
 def create_material_receipt(
 	items: dict, warehouse: str = "_Test Warehouse - _TC", qty: float = 100
 ) -> StockEntry:

erpnext/stock/report/stock_ageing/stock_ageing.py

@@ -287,6 +287,7 @@ class FIFOSlots:
 		self.serial_no_details = {}
 		self.batch_no_details = {}
 		self.batchwise_valuation_by_batch = {}
+		self.valuation_method_by_item = {}
 		self.filters = filters
 		self.sle = sle
 
@@ -307,9 +308,10 @@ class FIFOSlots:
 		self.prepare_stock_reco_voucher_wise_count()
 
 		if stock_ledger_entries is None:
-			# nested queries invalidate the streaming cursor below,
-			# so batchwise valuation flags must be resolved beforehand
+			# streaming path: nested queries invalidate the streaming cursor below,
+			# so batchwise valuation flags and item valuation methods must be resolved beforehand
 			self._prefetch_batchwise_valuations()
+			self._prefetch_valuation_methods()
 
 		with frappe.db.unbuffered_cursor():
 			if stock_ledger_entries is None:
@@ -321,12 +323,28 @@ class FIFOSlots:
 			# Note that stock_ledger_entries is an iterator, you can not reuse it like a list
 			del stock_ledger_entries
 
+		self._recompute_moving_average_slots()
+
 		if not self.filters.get("show_warehouse_wise_stock"):
 			# (Item 1, WH 1), (Item 1, WH 2) => (Item 1)
 			self.item_details = self._aggregate_details_by_item(self.item_details)
 
 		return self.item_details
 
+	def _recompute_moving_average_slots(self) -> None:
+		for item_dict in self.item_details.values():
+			if item_dict.get("has_serial_no") or item_dict.get("has_batch_no"):
+				continue
+
+			details = item_dict["details"]
+			if self._get_item_valuation_method(details.name) != "Moving Average":
+				continue
+
+			rate = flt(details.valuation_rate)
+			for slot in item_dict["fifo_queue"]:
+				if is_qty_slot(slot):
+					slot[FIFO_VALUE_INDEX] = flt(slot[FIFO_QTY_INDEX] * rate)
+
 	def _get_bundle_wise_details(self, stock_ledger_entries: list | None) -> tuple[dict, dict]:
 		if stock_ledger_entries is not None:
 			return frappe._dict({}), frappe._dict({})
@@ -347,7 +365,10 @@ class FIFOSlots:
 		if row.actual_qty > 0:
 			self._compute_incoming_stock(row, fifo_queue, transferred_item_key, serial_nos, batch_nos)
 		else:
-			self._compute_outgoing_stock(row, fifo_queue, transferred_item_key, serial_nos, batch_nos)
+			from_end = self._get_item_valuation_method(row.name) == "LIFO"
+			self._compute_outgoing_stock(
+				row, fifo_queue, transferred_item_key, serial_nos, batch_nos, from_end
+			)
 
 		self._update_balances(row, key)
 		self._trim_serial_fifo_queue(row, key, fifo_queue)
@@ -460,6 +481,45 @@ class FIFOSlots:
 		for batch_no, use_batchwise_valuation in query.run():
 			self.batchwise_valuation_by_batch[batch_no] = use_batchwise_valuation
 
+	def _get_item_valuation_method(self, item_code: str) -> str:
+		from erpnext.stock.utils import get_valuation_method
+
+		if item_code not in self.valuation_method_by_item:
+			# only reachable when stock ledger entries are passed in directly;
+			# the streaming path prefetches all methods before iteration
+			self.valuation_method_by_item[item_code] = get_valuation_method(
+				item_code, self.filters.get("company")
+			)
+
+		return self.valuation_method_by_item[item_code]
+
+	def _prefetch_valuation_methods(self) -> None:
+		from erpnext.stock.utils import get_valuation_method
+
+		company = self.filters.get("company")
+		sle = frappe.qb.DocType("Stock Ledger Entry")
+		item = frappe.qb.DocType("Item")
+		to_date = get_datetime(self.filters.get("to_date") + " 23:59:59")
+
+		query = (
+			frappe.qb.from_(sle)
+			.inner_join(item)
+			.on(sle.item_code == item.name)
+			.select(item.name, item.valuation_method)
+			.distinct()
+			.where((sle.company == company) & (sle.posting_datetime <= to_date) & (sle.is_cancelled != 1))
+		)
+		query = self._apply_filter(query, sle, "item_code")
+
+		# items with no item-level method share the company/settings default; resolve it once
+		default_method = None
+		for item_code, valuation_method in query.run():
+			if not valuation_method:
+				if default_method is None:
+					default_method = get_valuation_method(item_code, company)
+				valuation_method = default_method
+			self.valuation_method_by_item[item_code] = valuation_method
+
 	def _init_key_stores(self, row: dict) -> tuple:
 		"Initialise keys and FIFO Queue."
 
@@ -576,7 +636,13 @@ class FIFOSlots:
 		fifo_queue[0][FIFO_VALUE_INDEX] += flt(row.stock_value_difference)
 
 	def _compute_outgoing_stock(
-		self, row: dict, fifo_queue: list, transfer_key: tuple, serial_nos: list, batch_nos: list
+		self,
+		row: dict,
+		fifo_queue: list,
+		transfer_key: tuple,
+		serial_nos: list,
+		batch_nos: list,
+		from_end: bool = False,
 	):
 		"Update FIFO Queue on outward stock."
 		if serial_nos:
@@ -584,7 +650,7 @@ class FIFOSlots:
 		elif batch_nos:
 			self._consume_batch_fifo_slots(row, fifo_queue, transfer_key, batch_nos)
 		else:
-			self._consume_fifo_slots(row, fifo_queue, transfer_key)
+			self._consume_fifo_slots(row, fifo_queue, transfer_key, from_end)
 
 	def _consume_serial_fifo_slots(self, fifo_queue: list, serial_nos: list) -> None:
 		fifo_queue[:] = [slot for slot in fifo_queue if slot[FIFO_QTY_INDEX] not in serial_nos]
@@ -661,19 +727,23 @@ class FIFOSlots:
 		)
 		self.transferred_item_details[transfer_key].append([qty, row.posting_date, stock_value_difference])
 
-	def _consume_fifo_slots(self, row: dict, fifo_queue: list, transfer_key: tuple) -> None:
+	def _consume_fifo_slots(
+		self, row: dict, fifo_queue: list, transfer_key: tuple, from_end: bool = False
+	) -> None:
+		# LIFO consumes the most recent inward first, so pop from the tail instead of the head.
+		index = -1 if from_end else 0
 		qty_to_pop = abs(row.actual_qty)
 		stock_value = abs(row.stock_value_difference)
 
 		while qty_to_pop:
-			slot = fifo_queue[0] if fifo_queue else [0, None, 0]
+			slot = fifo_queue[index] if fifo_queue else [0, None, 0]
 			slot_qty = flt(slot[FIFO_QTY_INDEX])
 			slot_value = flt(slot[FIFO_VALUE_INDEX])
 
 			if 0 < slot_qty <= qty_to_pop:
 				qty_to_pop -= slot_qty
 				stock_value -= slot_value
-				self.transferred_item_details[transfer_key].append(fifo_queue.pop(0))
+				self.transferred_item_details[transfer_key].append(fifo_queue.pop(index))
 			elif not fifo_queue:
 				fifo_queue.append([-(qty_to_pop), row.posting_date, -(stock_value)])
 				self.transferred_item_details[transfer_key].append(

erpnext/stock/report/stock_ageing/test_stock_ageing.py

@@ -1,6 +1,8 @@
 # Copyright (c) 2022, Frappe Technologies Pvt. Ltd. and Contributors
 # See license.txt
 
+from unittest.mock import patch
+
 import frappe
 
 from erpnext.stock.report.stock_ageing.stock_ageing import FIFOSlots, format_report_data, get_average_age
@@ -63,6 +65,131 @@ class TestStockAgeing(ERPNextTestSuite):
 		data = format_report_data(self.filters, slots, self.filters["to_date"])
 		self.assertEqual(data[0][8], 40.0)  # valuating for stock value between age 0-30
 
+	def test_moving_average_value_ties_to_stock_balance(self):
+		"""For Moving Average items the queue value is re-derived as qty * rate so the
+		report's stock value ties to Stock Balance, instead of stranding a residual
+		from FIFO-by-qty consumption vs blended outgoing value."""
+		sle = [
+			frappe._dict(
+				name="MA Item",
+				actual_qty=10,
+				qty_after_transaction=10,
+				stock_value_difference=1000,
+				valuation_rate=100,
+				warehouse="WH 1",
+				posting_date="2021-12-01",
+				voucher_type="Stock Entry",
+				voucher_no="001",
+				has_serial_no=False,
+				serial_no=None,
+			),
+			frappe._dict(
+				name="MA Item",
+				actual_qty=10,
+				qty_after_transaction=20,
+				stock_value_difference=2000,
+				valuation_rate=150,
+				warehouse="WH 1",
+				posting_date="2021-12-02",
+				voucher_type="Stock Entry",
+				voucher_no="002",
+				has_serial_no=False,
+				serial_no=None,
+			),
+			frappe._dict(
+				name="MA Item",
+				actual_qty=(-10),
+				qty_after_transaction=10,
+				stock_value_difference=(-1500),
+				valuation_rate=150,
+				warehouse="WH 1",
+				posting_date="2021-12-03",
+				voucher_type="Stock Entry",
+				voucher_no="003",
+				has_serial_no=False,
+				serial_no=None,
+			),
+			frappe._dict(
+				name="MA Item",
+				actual_qty=(-5),
+				qty_after_transaction=5,
+				stock_value_difference=(-750),
+				valuation_rate=150,
+				warehouse="WH 1",
+				posting_date="2021-12-04",
+				voucher_type="Stock Entry",
+				voucher_no="004",
+				has_serial_no=False,
+				serial_no=None,
+			),
+		]
+
+		with patch("erpnext.stock.utils.get_valuation_method", return_value="Moving Average"):
+			slots = FIFOSlots(self.filters, sle).generate()
+
+		queue = slots["MA Item"]["fifo_queue"]
+		total_value = sum(slot[2] for slot in queue)
+
+		# Stock Balance bal_val = qty_after_transaction * valuation_rate = 5 * 150
+		self.assertEqual(total_value, 750.0)
+
+	def test_lifo_consumes_newest_first(self):
+		"""LIFO items consume the most recent inward first, so the oldest lot stays on
+		hand. The remaining queue, stock value and average age must reflect the older
+		stock, unlike the default FIFO which retains the newest lots."""
+		sle = [
+			frappe._dict(
+				name="LIFO Item",
+				actual_qty=30,
+				qty_after_transaction=30,
+				stock_value_difference=30,
+				warehouse="WH 1",
+				posting_date="2021-12-01",
+				voucher_type="Stock Entry",
+				voucher_no="001",
+				has_serial_no=False,
+				serial_no=None,
+			),
+			frappe._dict(
+				name="LIFO Item",
+				actual_qty=20,
+				qty_after_transaction=50,
+				stock_value_difference=20,
+				warehouse="WH 1",
+				posting_date="2021-12-02",
+				voucher_type="Stock Entry",
+				voucher_no="002",
+				has_serial_no=False,
+				serial_no=None,
+			),
+			frappe._dict(
+				name="LIFO Item",
+				actual_qty=(-10),
+				qty_after_transaction=40,
+				stock_value_difference=(-10),
+				warehouse="WH 1",
+				posting_date="2021-12-03",
+				voucher_type="Stock Entry",
+				voucher_no="003",
+				has_serial_no=False,
+				serial_no=None,
+			),
+		]
+
+		with patch("erpnext.stock.utils.get_valuation_method", return_value="LIFO"):
+			slots = FIFOSlots(self.filters, sle).generate()
+
+		queue = slots["LIFO Item"]["fifo_queue"]
+
+		# newest lot (day 2) is consumed first: oldest 30 stays, newest drops 20 -> 10
+		self.assertEqual(queue[0][0], 30.0)
+		self.assertEqual(queue[-1][0], 10.0)
+		self.assertEqual(sum(slot[0] for slot in queue), 40.0)
+		self.assertEqual(sum(slot[2] for slot in queue), 40.0)
+
+		# average age skews older than the FIFO result (8.5) because the old lot is retained
+		self.assertEqual(get_average_age(queue, self.filters["to_date"]), 8.75)
+
 	def test_insufficient_balance(self):
 		"Reference: Case 3 in stock_ageing_fifo_logic.md (same wh)"
 		sle = [

erpnext/templates/pages/projects.py

@@ -6,21 +6,12 @@ import frappe
 
 
 def get_context(context):
-	project_user = frappe.db.get_value(
-		"Project User",
-		{"parent": frappe.form_dict.project, "user": frappe.session.user},
-		["user", "view_attachments", "hide_timesheets"],
-		as_dict=True,
-	)
-	if frappe.session.user != "Administrator" and (not project_user or frappe.session.user == "Guest"):
-		raise frappe.PermissionError
+	project_user = validate_and_get_project_user(project=frappe.form_dict.project)
 
 	context.no_cache = 1
 	context.show_sidebar = True
 	project = frappe.get_doc("Project", frappe.form_dict.project)
 
-	project.has_permission("read")
-
 	project.tasks = get_tasks(
 		project.name, start=0, item_status="open", search=frappe.form_dict.get("search")
 	)
@@ -64,6 +55,22 @@ def get_tasks(project, start=0, search=None, item_status=None):
 	return list(filter(lambda x: not x.parent_task, tasks))
 
 
+@frappe.whitelist()
+def get_task_html(project: str, start: int = 0, item_status: str | None = None):
+	validate_and_get_project_user(project=project)
+	return frappe.render_template(
+		"erpnext/templates/includes/projects/project_tasks.html",
+		{
+			"doc": {
+				"name": project,
+				"project_name": project,
+				"tasks": get_tasks(project, start, item_status=item_status),
+			}
+		},
+		is_path=True,
+	)
+
+
 def get_timesheets(project, start=0, search=None):
 	filters = {"project": project}
 	if search:
@@ -89,9 +96,28 @@ def get_timesheets(project, start=0, search=None):
 	return timesheets
 
 
+@frappe.whitelist()
+def get_timesheet_html(project: str, start: int = 0):
+	validate_and_get_project_user(project=project)
+	return frappe.render_template(
+		"erpnext/templates/includes/projects/project_timesheets.html",
+		{"doc": {"timesheets": get_timesheets(project, start)}},
+		is_path=True,
+	)
+
+
 def get_attachments(project):
 	return frappe.get_all(
 		"File",
 		filters={"attached_to_name": project, "attached_to_doctype": "Project", "is_private": 0},
 		fields=["file_name", "file_url", "file_size"],
 	)
+
+
+def validate_and_get_project_user(project: str):
+	project_doc = frappe.get_doc("Project", project)
+	project_doc.check_permission()
+
+	project_user = next((d for d in project_doc.users if d.user == frappe.session.user), None)
+
+	return project_user

erpnext/templates/pages/test_projects.py

@@ -0,0 +1,72 @@
+# Copyright (c) 2026, Frappe Technologies Pvt. Ltd. and Contributors
+# License: GNU General Public License v3. See license.txt
+
+import frappe
+
+from erpnext.projects.doctype.project.test_project import make_project
+from erpnext.templates.pages.projects import validate_and_get_project_user
+from erpnext.tests.utils import ERPNextTestSuite
+
+
+class TestProjectsPage(ERPNextTestSuite):
+	"""validate_and_get_project_user() gates the /projects portal page. It must raise
+	frappe.PermissionError for a user who can't read the Project, and otherwise return
+	that user's Project User row (or None if they're permitted but not listed as one --
+	e.g. an internal Projects Manager browsing the portal)."""
+
+	def _create_user(self, email):
+		if not frappe.db.exists("User", email):
+			frappe.get_doc(
+				{
+					"doctype": "User",
+					"email": email,
+					"first_name": "Portal",
+					"send_welcome_email": 0,
+				}
+			).insert(ignore_permissions=True)
+		return email
+
+	def test_raises_permission_error_for_user_without_access(self):
+		project = make_project({"project_name": f"_Test Portal Access {frappe.generate_hash(length=6)}"})
+		outsider = self._create_user(f"outsider_{frappe.generate_hash(length=6)}@example.com")
+
+		with self.set_user(outsider):
+			self.assertRaises(frappe.PermissionError, validate_and_get_project_user, project.name)
+
+	def test_allows_user_listed_as_project_user_and_returns_their_row(self):
+		# Being a Project User shares the Project with that user (see
+		# Project.control_access_for_project_users), which is what lets them past
+		# check_permission() here.
+		member = self._create_user(f"member_{frappe.generate_hash(length=6)}@example.com")
+
+		project = frappe.get_doc(
+			doctype="Project",
+			project_name=f"_Test Portal Access {frappe.generate_hash(length=6)}",
+			status="Open",
+			company="_Test Company",
+		)
+		project.append(
+			"users", {"user": member, "view_attachments": 1, "hide_timesheets": 1, "welcome_email_sent": 1}
+		)
+		project.insert()
+
+		with self.set_user(member):
+			project_user = validate_and_get_project_user(project.name)
+
+		self.assertIsNotNone(project_user)
+		self.assertEqual(project_user.user, member)
+		self.assertEqual(project_user.view_attachments, 1)
+		self.assertEqual(project_user.hide_timesheets, 1)
+
+	def test_allows_internally_permitted_user_not_listed_as_project_user(self):
+		# The permission gate must be the real permission system (check_permission()),
+		# not "is this user in the Project's users child table" -- a Projects Manager
+		# can open any project's portal page without ever being added as its user.
+		project = make_project({"project_name": f"_Test Portal Access {frappe.generate_hash(length=6)}"})
+		manager = self._create_user(f"manager_{frappe.generate_hash(length=6)}@example.com")
+		frappe.get_doc("User", manager).add_roles("Projects Manager")
+
+		with self.set_user(manager):
+			project_user = validate_and_get_project_user(project.name)
+
+		self.assertIsNone(project_user)