diff --git a/frappe/desk/reportview.py b/frappe/desk/reportview.py index 3666f30910..9a0e3dc2d7 100644 --- a/frappe/desk/reportview.py +++ b/frappe/desk/reportview.py @@ -357,14 +357,13 @@ def export_query(): form_params["limit_page_length"] = None form_params["as_list"] = True doctype = form_params.pop("doctype") + form_params["fields"].append(f"`tab{doctype}`.`owner`") file_format_type = form_params.pop("file_format_type") title = form_params.pop("title", doctype) csv_params = pop_csv_params(form_params) add_totals_row = 1 if form_params.pop("add_totals_row", None) == "1" else None translate_values = 1 if form_params.pop("translate_values", None) == "1" else None - frappe.permissions.can_export(doctype, raise_exception=True) - if selection := form_params.pop("selected_items", None): form_params["filters"] = {"name": ("in", json.loads(selection))} @@ -378,6 +377,16 @@ def export_query(): db_query = DatabaseQuery(doctype) ret = db_query.execute(**form_params) + if not frappe.permissions.can_export(doctype): + if frappe.permissions.can_export(doctype, is_owner=True): + for row in ret: + if row[-1] != frappe.session.user: + raise frappe.PermissionError( + _("You are not allowed to export {} doctype").format(doctype) + ) + else: + raise frappe.PermissionError(_("You are not allowed to export {} doctype").format(doctype)) + if add_totals_row: ret = append_totals_row(ret) diff --git a/frappe/permissions.py b/frappe/permissions.py index f37d8bb550..44878710f7 100644 --- a/frappe/permissions.py +++ b/frappe/permissions.py @@ -593,11 +593,11 @@ def can_import(doctype, raise_exception=False): return True -def can_export(doctype, raise_exception=False): +def can_export(doctype, raise_exception=False, is_owner=False): if "System Manager" in frappe.get_roles(): return True else: - role_permissions = frappe.permissions.get_role_permissions(doctype) + role_permissions = frappe.permissions.get_role_permissions(doctype, is_owner=is_owner) has_access = role_permissions.get("export") or role_permissions.get("if_owner").get("export") if not has_access and raise_exception: raise frappe.PermissionError(_("You are not allowed to export {} doctype").format(doctype))