vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge pull request #23031 from ankush/perm_search

Browse source 
fix: enforce perms on global search
This commit is contained in:
Ankush Menat 2023-10-31 21:57:38 +05:30 • committed by GitHub
commit 2375f2ee05
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
frappe/utils/global_search.py
View file

@ -446,7 +446,9 @@ def search(text, start=0, limit=20, doctype=""):
results = []
sorted_results = []
allowed_doctypes = get_doctypes_for_global_search()
allowed_doctypes = set(get_doctypes_for_global_search()) & set(frappe.get_user().get_can_read())
if not allowed_doctypes or (doctype and doctype not in allowed_doctypes):
return []
for word in set(text.split("&")):
word = word.strip()
@ -464,7 +466,7 @@ def search(text, start=0, limit=20, doctype=""):
if doctype:
query = query.where(global_search.doctype == doctype)
elif allowed_doctypes:
else:
query = query.where(global_search.doctype.isin(allowed_doctypes))
if cint(start) > 0: