fix: validation permission on tag creation (frappe#22753)

* fix: validation permission on `tag` creation * refactor: apply checks on all operations Add/remove both are controlled by update --------- Co-authored-by: Ankush Menat <[email protected]>
metalmon · Oct 16, 2023 · d06a580 · d06a580
1 parent db3e4c9
commit d06a580
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/frappe/desk/doctype/tag/tag.py b/frappe/desk/doctype/tag/tag.py
@@ -48,8 +48,6 @@ def add_tags(tags, dt, docs, color=None):
 		for tag in tags:
 			DocTags(dt).add(doc, tag)
 
-	# return tag
-
 
 @frappe.whitelist()
 def remove_tag(tag, dt, dn):
@@ -153,6 +151,7 @@ def update_tags(doc, tags):
 
 	:param doc: Document to be added to global tags
 	"""
+	doc.check_permission("write")
 	new_tags = {tag.strip() for tag in tags.split(",") if tag}
 	existing_tags = [
 		tag.tag