vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: Apply permissions on Report sidebar

Browse source 
Alternate to https://github.com/frappe/frappe/pull/19588

Co-Authored-By: marination <maricadsouza221197@gmail.com>
This commit is contained in:
Ankush Menat 2023-02-03 18:07:21 +05:30
parent ccaf4c1e7e
commit 6dcf12d509
2 changed files with 50 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
frappe/boot.py
View file

@ -234,7 +234,7 @@ def get_user_pages_or_reports(parent, cache=False):
has_role[p.name] = {"modified": p.modified, "title": p.title}
elif parent == "Report":
reports = frappe.get_all(
reports = frappe.get_list(
"Report",
fields=["name", "report_type"],
filters={"name": ("in", has_role.keys())},
@ -243,6 +243,10 @@ def get_user_pages_or_reports(parent, cache=False):
for report in reports:
has_role[report.name]["report_type"] = report.report_type
non_permitted_reports = set(has_role.keys()) - {r.name for r in reports}
for r in non_permitted_reports:
has_role.pop(r, None)
# Expire every six hours
_cache.set_value("has_role:" + parent, has_role, frappe.session.user, 21600)
return has_role

46
frappe/tests/test_boot.py
View file

@ -1,5 +1,5 @@
import frappe
from frappe.boot import get_unseen_notes
from frappe.boot import get_unseen_notes, get_user_pages_or_reports
from frappe.desk.doctype.note.note import mark_as_seen
from frappe.tests.utils import FrappeTestCase
@ -26,3 +26,47 @@ class TestBootData(FrappeTestCase):
mark_as_seen(note.name)
unseen_notes = [d.title for d in get_unseen_notes()]
self.assertListEqual(unseen_notes, [])
def test_get_user_pages_or_reports_with_permission_query(self):
# Create a ToDo custom report with admin user
frappe.set_user("Administrator")
frappe.get_doc(
{
"doctype": "Report",
"ref_doctype": "ToDo",
"report_name": "Test Admin Report",
"report_type": "Report Builder",
"is_standard": "No",
}
).insert()
# Add permission query such that each user can only see their own custom reports
frappe.get_doc(
dict(
doctype="Server Script",
name="test_report_permission_query",
script_type="Permission Query",
reference_doctype="Report",
script="""conditions = f"(`tabReport`.is_standard = 'Yes' or `tabReport`.owner = '{frappe.session.user}')"
""",
)
).insert()
# Create a ToDo custom report with test user
frappe.set_user("test@example.com")
frappe.get_doc(
{
"doctype": "Report",
"ref_doctype": "ToDo",
"report_name": "Test User Report",
"report_type": "Report Builder",
"is_standard": "No",
}
).insert(ignore_permissions=True)
get_user_pages_or_reports("Report")
allowed_reports = frappe.cache().get_value("has_role:Report", user=frappe.session.user)
# Test user must not see admin user's report
self.assertNotIn("Test Admin Report", allowed_reports)
self.assertIn("Test User Report", allowed_reports)