Erpnext: Website users don't have read access to GL Entry

[brownharryb]

Is there a reason why website users don't have read access to the GL Entry doctype but have access to doctypes like Sales Invoices and Request For Quotation?

[jwrober]

My question would be - why would you want that? GL is back end. SINV and RFQ for for customers, which would be for website users.

[brownharryb]

The general ledger report which is based on the GL Entry contains information filtered for each customer, and I want to be able to display these information to the customer in the web portal, no point recreating this functionality since they are all in the general ledger.

[ckosiegbu]

I guess you need like a portal view of the Statement of Account that is generated when the general ledger is printed

General Ledger View

Statement of Account View

Hi @umairsy is there any specific reason why the GL Entry doctype does not give permission to the role All for display? Other doctypes give this permission to All.

[jwrober]

I see this as a major security issue. You should not expose major back-end functionality like this to a web portal. I still don't understand the use case. What is it you are trying to accomplish? How can you control what the customer sees when the way things work now you can't hard code filters and such.

[ckosiegbu]

The use case is the ability of a Customer to view a statement of all his/her Accounts Receivable interactions (sales invoices, payments, journal entry) on the portal view. We are not looking to reproduce the reporting view but a constrained view that by default filters the transaction listed to those of the logged in user only. Something like the screenshot below.

[ckosiegbu]

I think another way to ask the question is, what is the best way to give a web user access to all the accounting transactions they have made on the ERPNext?

[jwrober]

And being able to activate quotes, orders, invoices and shipments out of the box is not enough?

[ckosiegbu]

I don't think these are enough since the ability to view an online customer statement is a reasonable feature to expect (especially for subscription-type services) and quotes, orders, invoices and shipments don't make a customer statement. Customer-related Sales Invoices, Payments and Journal Entries do and they all already happen to be in the GL Entry doctype.

I don't see why GL Entry shouldn't have read-access for role All (especially when the All role can already read all Sales Invoices by default).

[rmehta]

I agree with @ckosiegbu, GL report should be a specially configured feature if required, not based on permissions