fix: check document access in SLA reset and payment reference count

(cherry picked from commit 0ce7848a8a)

# Conflicts:
#	erpnext/accounts/doctype/unreconcile_payment/test_unreconcile_payment.py
#	erpnext/support/doctype/issue/test_issue.py

erpnext/accounts/doctype/unreconcile_payment/test_unreconcile_payment.py

@@ -610,6 +610,33 @@ class TestUnreconcilePayment(AccountsTestMixin, FrappeTestCase):
 		po.reload()
 		self.assertEqual(po.advance_paid, 0)
 
+<<<<<<< HEAD
+=======
+	def test_reference_count_needs_voucher_read(self):
+		from erpnext.accounts.doctype.unreconcile_payment.unreconcile_payment import doc_has_references
+
+		si = self.create_sales_invoice()
+		pe = self.create_payment_entry()
+		pe.append(
+			"references",
+			{"reference_doctype": si.doctype, "reference_name": si.name, "allocated_amount": 100},
+		)
+		pe.save().submit()
+
+		inside = make_company_fenced_user("unrec-count@example.com", ["Accounts User"], self.company)
+		with as_user(inside):
+			self.assertEqual(doc_has_references(si.doctype, si.name), 1)
+			self.assertRaises(frappe.ValidationError, doc_has_references, si.doctype, "")
+
+		outside = make_company_fenced_user("unrec-count@example.com", ["Accounts User"], "_Test Company 1")
+		with as_user(outside):
+			self.assertRaises(frappe.PermissionError, doc_has_references, si.doctype, si.name)
+
+	def test_unreconcile_selection_fences_the_voucher(self):
+		from erpnext.accounts.doctype.unreconcile_payment.unreconcile_payment import (
+			create_unreconcile_doc_for_selection,
+		)
+>>>>>>> 0ce7848 (fix: check document access in SLA reset and payment reference count)
 
 class TestUnreconcilePaymentPermissions(AccountsTestMixin, FrappeTestCase):
 	def setUp(self):

erpnext/accounts/doctype/unreconcile_payment/unreconcile_payment.py

@@ -80,6 +80,10 @@ class UnreconcilePayment(Document):
 
 @frappe.whitelist()
 def doc_has_references(doctype: str | None = None, docname: str | None = None):
+	if not doctype or not docname:
+		frappe.throw(_("{0} and {1} are required").format(frappe.bold("doctype"), frappe.bold("docname")))
+	frappe.has_permission(doctype, "read", doc=docname, throw=True)
+
 	count = 0
 	if doctype in ["Sales Invoice", "Purchase Invoice"]:
 		count = frappe.db.count(

erpnext/support/doctype/issue/test_issue.py

@@ -228,8 +228,82 @@ class TestIssue(TestSetUp):
 		).insert(ignore_permissions=True)
 		issue = make_issue(customer="_Test Customer")
 
+<<<<<<< HEAD
 		with as_user(user):
 			self.assertNotIn(issue.name, [d.name for d in get_issue_list("Issue", None, None, 0, 500)])
+=======
+		issue = make_issue(index=1)
+		issue.reload()
+		issue.status = "Closed"
+		issue.save()
+
+		self.assertEqual(
+			frappe.get_all("ToDo", {"reference_type": "Issue", "reference_name": issue.name}, pluck="status"),
+			["Closed"],
+		)
+
+	def test_sla_whitelisted_methods_use_session_permissions(self):
+		from erpnext.support.doctype.service_level_agreement.service_level_agreement import (
+			get_service_level_agreement_filters,
+			reset_service_level_agreement,
+		)
+
+		frappe.db.set_single_value("Support Settings", "allow_resetting_service_level_agreement", 1)
+		issue = make_issue(get_datetime("2019-03-04 12:00"), "_Test Customer", 1)
+		reset_service_level_agreement("Issue", issue.name, "customer asked", "someone@example.com")
+		self.assertEqual(
+			frappe.db.get_value(
+				"Comment", {"reference_name": issue.name, "comment_type": "Info"}, "comment_email"
+			),
+			"Administrator",
+		)
+
+		website_user = create_user("test_sla_website_user@example.com")
+		website_user.db_set("user_type", "Website User")
+		frappe.set_user(website_user.name)
+		try:
+			self.assertRaises(
+				frappe.PermissionError,
+				get_service_level_agreement_filters,
+				"Issue",
+				issue.service_level_agreement,
+				"_Test Customer",
+			)
+			self.assertRaises(
+				frappe.PermissionError, reset_service_level_agreement, "Issue", issue.name, "not mine"
+			)
+		finally:
+			frappe.set_user("Administrator")
+		self.assertFalse(
+			frappe.db.exists("Comment", {"reference_name": issue.name, "content": ["like", "%not mine%"]})
+		)
+
+	def test_update_agreement_status_on_custom_status(self):
+		from erpnext.support.doctype.service_level_agreement.service_level_agreement import (
+			update_agreement_status_on_custom_status,
+		)
+
+		issue = make_issue(get_datetime("2019-03-04 12:00"), index=1)
+		issue.first_responded_on = get_datetime("2019-03-04 13:00")
+		update_agreement_status_on_custom_status(issue)
+		self.assertEqual(issue.agreement_status, "Resolution Due")
+
+	def test_resetting_sla_of_resolved_issue_recalculates_deadlines(self):
+		from erpnext.support.doctype.service_level_agreement.service_level_agreement import (
+			reset_service_level_agreement,
+		)
+
+		frappe.db.set_single_value("Support Settings", "allow_resetting_service_level_agreement", 1)
+		issue = make_issue(get_datetime("2019-03-04 12:00"), index=1)
+		frappe.flags.current_time = get_datetime("2019-03-04 13:00")
+		issue.status = "Closed"
+		issue.save()
+		old_response_by = issue.response_by
+
+		reset_service_level_agreement("Issue", issue.name, "customer asked")
+		issue.reload()
+		self.assertGreater(get_datetime(issue.response_by), get_datetime(old_response_by))
+>>>>>>> 0ce7848 (fix: check document access in SLA reset and payment reference count)
 
 	def test_recording_of_assignment_on_first_reponse_failure(self):
 		from frappe.desk.form.assign_to import add as add_assignment

erpnext/support/doctype/service_level_agreement/service_level_agreement.py

@@ -790,6 +790,7 @@ def reset_service_level_agreement(doctype: str, docname: str, reason, user):
 		frappe.throw(_("Allow Resetting Service Level Agreement from Support Settings."))
 
 	doc = frappe.get_doc(doctype, docname)
+	doc.check_permission("write")
 	frappe.get_doc(
 		{
 			"doctype": "Comment",