From 13162d8fbdbdfbc531b7bfb35b911c5bf22a8444 Mon Sep 17 00:00:00 2001 From: Ankush Menat Date: Mon, 30 Jan 2023 11:24:16 +0530 Subject: [PATCH] fix: Only apply perm query to non-admin users --- frappe/boot.py | 4 ++-- frappe/tests/test_boot.py | 3 --- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/frappe/boot.py b/frappe/boot.py index 8eed64b2dc..de3753f754 100644 --- a/frappe/boot.py +++ b/frappe/boot.py @@ -259,8 +259,8 @@ def _run_with_permission_query(query: "Query", doctype: str) -> list[dict]: Note: Works only if 'WHERE' is the last clause in the query """ permission_query = DatabaseQuery(doctype, frappe.session.user).get_permission_query_conditions() - if permission_query: - return frappe.db.sql(f"{query} AND {permission_query}", as_dict=True) # nosemgrep + if permission_query and frappe.session.user != "Administrator": + return frappe.db.sql(f"{query} AND {permission_query}", as_dict=True) return query.run(as_dict=True) diff --git a/frappe/tests/test_boot.py b/frappe/tests/test_boot.py index ece2c181df..232c379e08 100644 --- a/frappe/tests/test_boot.py +++ b/frappe/tests/test_boot.py @@ -70,6 +70,3 @@ class TestBootData(FrappeTestCase): # Test user must not see admin user's report self.assertNotIn("Test Admin Report", allowed_reports) self.assertIn("Test User Report", allowed_reports) - - self.addCleanup(frappe.db.rollback) - self.addCleanup(frappe.set_user, "Administrator")