fix(stock): check warehouse user permission in projected, batch and latest stock qty

(cherry picked from commit 7d70ea9e25)

# Conflicts:
#	erpnext/stock/utils.py

erpnext/stock/get_item_details.py

@@ -1741,6 +1741,7 @@ def get_projected_qty(item_code: str, warehouse: str):
 	# record-level read on the item, matching what get_item_details() in this file already does.
 	# Nothing in the tree calls this, so there is no caller whose roles constrain the choice.
 	frappe.has_permission("Item", doc=item_code, throw=True)
+	erpnext.require_user_permission("Warehouse", warehouse)
 
 	return {
 		"projected_qty": frappe.db.get_value(
@@ -1808,6 +1809,7 @@ def get_company_total_stock(item_code, company):
 def get_batch_qty(batch_no: str, warehouse: str, item_code: str):
 	from erpnext.stock.doctype.batch import batch
 
+	erpnext.require_user_permission("Warehouse", warehouse)
 	if batch_no:
 		return {"actual_batch_qty": batch.get_batch_qty(batch_no, warehouse)}
 

erpnext/stock/utils.py

@@ -205,6 +205,15 @@ def get_latest_stock_qty(item_code, warehouse=None):
 	# same guard as get_stock_balance above, which returns the same Bin quantity. Loser-free for
 	# the only caller: Work Order write is held by Manufacturing User, who holds Item read.
 	frappe.has_permission("Item", "read", throw=True)
+<<<<<<< HEAD
+=======
+	check_warehouse_company(warehouse)
+	if warehouse:
+		erpnext.require_user_permission("Warehouse", warehouse)
+
+	bin_dt = frappe.qb.DocType("Bin")
+	query = frappe.qb.from_(bin_dt).select(Sum(bin_dt.actual_qty)).where(bin_dt.item_code == item_code)
+>>>>>>> 7d70ea9 (fix(stock): check warehouse user permission in projected, batch and latest stock qty)
 
 	values, condition = [item_code], ""
 	if warehouse: