frappe/hrms BOLA/BFLA fix: Enhanced permission checks for shift, interview, and salary operations

Vulnerability Overview This page primarily describes the update contents of frappe/hrms version v16.11.0, including new features and bug fixes. The security-related bug fixes involved are as follows: 1. Enhanced Permission Checks: - Permission checks were added when inserting shifts to ensure that only authorized users can update or delete adjacent Shift Assignment records. - Permission checks were added to certain operations for Interview, Leave Application, and Salary Structure to ensure that only authorized users can utilize these features. 2. Data Consistency Improvements: - When creating a Payment Entry in the same currency as the company, the Exchange Gain/Loss Account is no longer required. - The configured Leave Period is now used to schedule half-yearly leave, rather than the calendar year. - Harmless warnings were removed from the message log when company settings are configured, while actual errors are logged for subsequent review. - When a Vehicle Log is cancelled, its associated vehicle expenses are removed from the related Expense Claims. - Salary deductions in Additional Salary no longer directly return amounts from Employee Advance; instead, they are linked to relevant entries via Additional Salary, and new deductions are blocked if the employee exceeds the remaining advance amount. Impact Scope Enhanced Permission Checks: Affects all users involved in shift insertion, as well as operations on Interview, Leave Application, and Salary Structure. Data Consistency Improvements: Affects all users utilizing Payment Entry, Leave Policy Assignment, Vehicle Log, and Additional Salary features. Remediation Enhanced Permission Checks: - Permission checks were added when inserting shifts to ensure that only authorized users can update or delete adjacent Shift Assignment records. - Permission checks were added to certain operations for Interview, Leave Application, and Salary Structure to ensure that only authorized users can utilize these features. Data Consistency Improvements: - When creating a Payment Entry in the same currency as the company, the Exchange Gain/Loss Account is no longer required. - The configured Leave Period is now used to schedule half-yearly leave, rather than the calendar year. - Harmless warnings were removed from the message log when company settings are configured, while actual errors are logged for subsequent review. - When a Vehicle Log is cancelled, its associated vehicle expenses are removed from the related Expense Claims. - Salary deductions in Additional Salary no longer directly return amounts from Employee Advance; instead, they are linked to relevant entries via Additional Salary, and new deductions are blocked if the employee exceeds the remaining advance amount. POC Code or Exploit Code No specific POC code or exploit code was included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

frappe/hrms BOLA/BFLA fix: Enhanced permission checks for shift, interview, and salary operations

More from this source