CalvinBackup/erpnext
1
0
Fork 0
mirror of https://github.com/frappe/erpnext.git synced 2026-03-07 20:42:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: better permissions on make payment request

Browse Source 
(cherry picked from commit f36962fc58)
This commit is contained in:
ruthra kumar
2026-02-16 13:19:10 +05:30
committed by Mergify
parent f5fa1ba02b
commit a5c83dd11e
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
erpnext/accounts/doctype/payment_request/payment_request.py
View File

@@ -539,8 +539,6 @@ class PaymentRequest(Document):
def make_payment_request(**args): def make_payment_request(**args):
"""Make payment request""" """Make payment request"""
frappe.has_permission(doctype="Payment Request", ptype="write", throw=True)
args = frappe._dict(args) args = frappe._dict(args)
if args.dt not in ALLOWED_DOCTYPES_FOR_PAYMENT_REQUEST: if args.dt not in ALLOWED_DOCTYPES_FOR_PAYMENT_REQUEST:
frappe.throw(_("Payment Requests cannot be created against: {0}").format(frappe.bold(args.dt))) frappe.throw(_("Payment Requests cannot be created against: {0}").format(frappe.bold(args.dt)))
@@ -548,6 +546,9 @@ def make_payment_request(**args):
if args.dn and not isinstance(args.dn, str): if args.dn and not isinstance(args.dn, str):
frappe.throw(_("Invalid parameter. 'dn' should be of type str")) frappe.throw(_("Invalid parameter. 'dn' should be of type str"))
frappe.has_permission("Payment Request", "create", throw=True)
frappe.has_permission(args.dt, "read", args.dn, throw=True)
ref_doc = args.ref_doc or frappe.get_doc(args.dt, args.dn) ref_doc = args.ref_doc or frappe.get_doc(args.dt, args.dn)
if not args.get("company"): if not args.get("company"):
args.company = ref_doc.company args.company = ref_doc.company
@@ -821,7 +822,7 @@ def get_print_format_list(ref_doctype):
return {"print_format": print_format_list} return {"print_format": print_format_list}
@frappe.whitelist(allow_guest=True) @frappe.whitelist()
def resend_payment_email(docname): def resend_payment_email(docname):
return frappe.get_doc("Payment Request", docname).send_email() return frappe.get_doc("Payment Request", docname).send_email()