Password on saving/submitting a form

ERPNext Customize ERPNext
1

Hi,

I want to add a functionality to erpnext in which I want the logged in user to enter his/her password on saving or submitting a form.

Does such a functionality exist?

Thanks

2

Currently no, but can you explain me your use case, as there are hundreds of Invoices and other Documents which requires submission in ERPNext and every time entering password can be a bit overwhelming.

3

Hi, Thanks for replying.

Basically i want a user verification prior to saving/submitting a document.

On saving/submitting a document, I want the software to prompt for password, and only after entering the correct password is the form saved/submitted.

eg. employee creates a sales invoice, on submitting it, he/she has to enter password for final submission.

Thanks

4

Why not use Workflow?
Also, you can create a Feature Request on Github if required.

5

I solved it.

I added a custom script for the doctype.
I’m pasting the solution for reference.

frappe.ui.form.on(‘Sales Invoice’, {
before_submit: function(frm) {
freeze:true
frappe.validated = false
frappe.verify_password(function(){
cur_frm.save(“Submit”);
});
}
})

1 Like
6

It’s a creative solution. Just one thing to note: a knowledgable user could bypass this quite easily, so don’t depend on it for actual security.

7

please explain the security loophole? Any suggestions on improving it?

8

Since that code is injected from the client side, a user could just open up the console and remove the trigger before saving. A secure solution would have to use server code, but I don’t know much about how frappe does session management.

9

will putting the same script on server side script solve this issue?

10

nevermind, those are python scripts

11

I suspect the same thing could be accomplished on the server-side (which is, as you’ve identified, done in python), but I don’t know the specifics.