fix(accounts): validate payment order bank account and reference company

(cherry picked from commit 2de828812f)

erpnext/accounts/doctype/payment_entry/payment_entry.py

@@ -3593,6 +3593,7 @@ def make_payment_order(source_name, target_doc=None):
 
 	def set_missing_values(source, target):
 		target.payment_order_type = "Payment Entry"
+		target.company = target.company or source.company
 		target.append(
 			"references",
 			dict(
@@ -3613,6 +3614,8 @@ def make_payment_order(source_name, target_doc=None):
 			"Payment Entry": {
 				"doctype": "Payment Order",
 				"validation": {"docstatus": ["=", 1]},
+				# keep the company of an existing order; references are validated against it
+				"field_no_map": ["company"] if target_doc else [],
 			}
 		},
 		target_doc,

erpnext/accounts/doctype/payment_order/payment_order.js

@@ -7,12 +7,21 @@ frappe.ui.form.on("Payment Order", {
 			return {
 				filters: {
 					is_company_account: 1,
+					company: frm.doc.company,
+					disabled: 0,
 				},
 			};
 		});
 
 		frm.set_df_property("references", "cannot_add_rows", true);
 	},
+	company: function (frm) {
+		frm.set_value({
+			company_bank_account: "",
+			company_bank: "",
+			account: "",
+		});
+	},
 	refresh: function (frm) {
 		if (frm.doc.docstatus == 0) {
 			frm.add_custom_button(
@@ -75,6 +84,7 @@ frappe.ui.form.on("Payment Order", {
 				party: frm.doc.supplier || "",
 			},
 			get_query_filters: {
+				company: frm.doc.company,
 				bank: frm.doc.bank,
 				docstatus: 1,
 				payment_type: ["!=", "Receive"],
@@ -96,6 +106,7 @@ frappe.ui.form.on("Payment Order", {
 				party: frm.doc.supplier || "",
 			},
 			get_query_filters: {
+				company: frm.doc.company,
 				bank: frm.doc.bank,
 				docstatus: 1,
 				status: ["=", "Initiated"],

erpnext/accounts/doctype/payment_order/payment_order.py

@@ -35,6 +35,59 @@ class PaymentOrder(Document):
 		references: DF.Table[PaymentOrderReference]
 	# end: auto-generated types
 
+	def validate(self):
+		self.validate_company_bank_account()
+		self.validate_reference_company()
+
+	def validate_reference_company(self):
+		if not self.payment_order_type:
+			return
+
+		ref_field = "payment_request" if self.payment_order_type == "Payment Request" else "reference_name"
+		references = {d.get(ref_field) for d in self.references if d.get(ref_field)}
+		if not references:
+			return
+
+		reference_company = frappe._dict(
+			frappe.get_all(
+				self.payment_order_type,
+				filters={"name": ["in", list(references)]},
+				fields=["name", "company"],
+				as_list=True,
+			)
+		)
+		for d in self.references:
+			company = reference_company.get(d.get(ref_field))
+			if company and company != self.company:
+				frappe.throw(
+					_("Row #{0}: {1} {2} belongs to Company {3}, not {4}").format(
+						d.idx, _(self.payment_order_type), d.get(ref_field), company, self.company
+					)
+				)
+
+	def validate_company_bank_account(self):
+		if not self.company_bank_account:
+			return
+
+		bank_account = frappe.get_cached_value(
+			"Bank Account",
+			self.company_bank_account,
+			["is_company_account", "company", "disabled", "bank", "account"],
+			as_dict=True,
+		)
+		if not bank_account or bank_account.disabled:
+			frappe.throw(_("Bank Account {0} is missing or disabled").format(self.company_bank_account))
+
+		if not bank_account.is_company_account or bank_account.company != self.company:
+			frappe.throw(
+				_("Bank Account {0} must be a company account belonging to {1}").format(
+					self.company_bank_account, self.company
+				)
+			)
+
+		self.company_bank = bank_account.bank
+		self.account = bank_account.account
+
 	def on_submit(self):
 		self.update_payment_status()
 

erpnext/accounts/doctype/payment_order/test_payment_order.py

@@ -26,6 +26,10 @@ class TestPaymentOrder(FrappeTestCase):
 			gl_account=self.gl_account, bank_account_name="Checking Account " + uniq_identifier
 		)
 
+		frappe.db.set_value(
+			"Bank Account", self.bank_account, {"is_company_account": 1, "company": "_Test Company"}
+		)
+
 	def tearDown(self):
 		frappe.db.rollback()
 

erpnext/accounts/doctype/payment_request/payment_request.py

@@ -1040,6 +1040,7 @@ def make_payment_order(source_name, target_doc=None):
 
 	def set_missing_values(source, target):
 		target.payment_order_type = "Payment Request"
+		target.company = target.company or source.company
 		target.append(
 			"references",
 			{
@@ -1061,6 +1062,8 @@ def make_payment_order(source_name, target_doc=None):
 		{
 			"Payment Request": {
 				"doctype": "Payment Order",
+				# keep the company of an existing order; references are validated against it
+				"field_no_map": ["company"] if target_doc else [],
 			}
 		},
 		target_doc,