From 72228946e5ae7f7bd27fa7f383859069aefb6f9d Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Mon, 2 Sep 2019 16:32:38 +0530
Subject: [PATCH] refactor: explicitly set ignore_permissions for file upload

---
 frappe/handler.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/frappe/handler.py b/frappe/handler.py
index 4f36beb849..5ac2884140 100755
--- a/frappe/handler.py
+++ b/frappe/handler.py
@@ -141,9 +141,13 @@ def uploadfile():
 
 @frappe.whitelist(allow_guest=True)
 def upload_file():
+	ignore_permissions = False
 	if frappe.session.user == 'Guest' and \
 		not frappe.get_system_settings('allow_guests_to_upload_files'):
 		return
+	else:
+		ignore_permissions = True
+
 	files = frappe.request.files
 	is_private = frappe.form_dict.is_private
 	doctype = frappe.form_dict.doctype
@@ -186,7 +190,7 @@ def upload_file():
 			"is_private": cint(is_private),
 			"content": content
 		})
-		ret.save(ignore_permissions=True)
+		ret.save(ignore_permissions=ignore_permissions)
 		return ret