CalvinBackup/erpnext
1
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-03-23 13:12:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: validate permission before updating status (#53651)

Browse Source
This commit is contained in:
diptanilsaha
2026-03-19 20:19:29 +05:30
committed by GitHub
parent ffd3e90806
commit 8e17c722fb
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
erpnext/buying/doctype/purchase_order/purchase_order.py
View File

@@ -894,7 +894,7 @@ def get_list_context(context=None):
@frappe.whitelist()
def update_status(status: str, name: str):
po = frappe.get_lazy_doc("Purchase Order", name)
po = frappe.get_lazy_doc("Purchase Order", name, check_permission="write")
po.update_status(status)
po.update_delivered_qty_in_sales_order()

2
erpnext/selling/doctype/sales_order/sales_order.py
View File

@@ -1815,7 +1815,7 @@ def make_work_orders(items: str, sales_order: str, company: str, project: str |
@frappe.whitelist()
def update_status(status: str, name: str):
so = frappe.get_doc("Sales Order", name)
so = frappe.get_doc("Sales Order", name, check_permission="write")
so.update_status(status)

2
erpnext/stock/doctype/purchase_receipt/purchase_receipt.py
View File

@@ -1581,7 +1581,7 @@ def make_purchase_return(source_name: str, target_doc: str | Document | None = N
@frappe.whitelist()
def update_purchase_receipt_status(docname: str, status: str):
pr = frappe.get_lazy_doc("Purchase Receipt", docname)
pr = frappe.get_lazy_doc("Purchase Receipt", docname, check_permission="write")
pr.update_status(status)