fix(buying): embed only quotation fields on the RFQ portal page

(cherry picked from commit e9e5483651)

erpnext/buying/doctype/request_for_quotation/test_request_for_quotation.py

@@ -168,6 +168,21 @@ class TestRequestforQuotation(FrappeTestCase):
 		self.assertEqual(supplier_quotation_doc.get("items")[0].qty, 5)
 		self.assertEqual(supplier_quotation_doc.get("items")[0].amount, 500)
 
+	def test_portal_page_embeds_only_the_quotation_fields(self):
+		from erpnext.templates.pages.rfq import get_portal_doc
+
+		rfq = make_request_for_quotation()
+		portal_doc = get_portal_doc(rfq)
+		embedded = frappe.as_json(portal_doc)
+		for supplier in rfq.suppliers:
+			self.assertNotIn(supplier.supplier, embedded)
+
+		portal_doc["supplier"] = rfq.suppliers[0].supplier
+		for item in portal_doc["items"]:
+			item["rate"] = 100
+		supplier_quotation = frappe.get_doc("Supplier Quotation", create_supplier_quotation(portal_doc))
+		self.assertEqual(supplier_quotation.items[0].amount, 500)
+
 	def test_portal_supplier_quotation_is_built_from_the_rfq_rows(self):
 		make_request_for_quotation(
 			supplier_data=[{"supplier": "_Test Supplier 2", "supplier_name": "_Test Supplier 2"}]

erpnext/templates/includes/rfq.js

@@ -1,7 +1,7 @@
 // Copyright (c) 2015, Frappe Technologies Pvt. Ltd. and Contributors
 // License: GNU General Public License v3. See license.txt
 
-window.doc={{ doc.as_json() }};
+window.doc = {{ portal_doc | tojson }};
 
 $(document).ready(function() {
 	new rfq();

erpnext/templates/pages/rfq.py

@@ -21,9 +21,16 @@ def get_context(context):
 	context.doc.rfq_links = get_link_quotation(context.doc.supplier, context.doc.name)
 	unauthorized_user(context.doc.supplier)
 	update_supplier_details(context)
+	context.portal_doc = get_portal_doc(context.doc)
 	context["title"] = frappe.form_dict.name
 
 
+def get_portal_doc(rfq) -> dict:
+	"""The RFQ fields the supplier's quotation form needs."""
+	items = [{"name": item.name, "idx": item.idx, "qty": item.qty} for item in rfq.items]
+	return {"name": rfq.name, "items": items}
+
+
 def get_supplier():
 	doctype = frappe.form_dict.doctype
 	parties_doctype = "Request for Quotation Supplier" if doctype == "Request for Quotation" else doctype