From d04016d274195060bbe0d9e47f2a7e7803ff1372 Mon Sep 17 00:00:00 2001
From: Shariq Ansari <sharique.rik@gmail.com>
Date: Mon, 4 Oct 2021 21:57:10 +0530
Subject: [PATCH 01/46] fix: Fixed css for Primary Navbar template

---
 frappe/website/web_template/primary_navbar/primary_navbar.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frappe/website/web_template/primary_navbar/primary_navbar.html b/frappe/website/web_template/primary_navbar/primary_navbar.html
index 5d7267706a..b18ff6e81f 100644
--- a/frappe/website/web_template/primary_navbar/primary_navbar.html
+++ b/frappe/website/web_template/primary_navbar/primary_navbar.html
@@ -1,4 +1,4 @@
-<nav class="navbar navbar-primary navbar-expand-lg">
+<nav class="navbar navbar-primary navbar-expand-lg navbar-dark">
 	<div class="container">
 		<a class="navbar-brand" href="{{ url_prefix }}{{ home_page or "/" }}">
 			{%- if brand_html -%}

From 231a04b50957a844f78fb984642941867b6b622d Mon Sep 17 00:00:00 2001
From: Shariq Ansari <sharique.rik@gmail.com>
Date: Thu, 14 Oct 2021 15:00:23 +0530
Subject: [PATCH 02/46] fix: Using svg for menu icon for mobile view

---
 frappe/public/scss/website/navbar.scss           | 16 ++++++++++++++++
 frappe/templates/doc.html                        |  6 +++++-
 frappe/templates/includes/navbar/navbar.html     |  6 +++++-
 .../primary_navbar/primary_navbar.html           |  8 ++++++--
 4 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/frappe/public/scss/website/navbar.scss b/frappe/public/scss/website/navbar.scss
index 3496a8907c..d70d064d58 100644
--- a/frappe/public/scss/website/navbar.scss
+++ b/frappe/public/scss/website/navbar.scss
@@ -13,6 +13,10 @@
 .navbar-light {
 	border-bottom: 1px solid $border-color;
 	background: $navbar-bg;
+
+	.navbar-toggler .icon {
+		stroke: none;
+	}
 }
 
 .navbar-primary {
@@ -25,6 +29,10 @@
 		}
 	}
 
+	.navbar-brand {
+		color: white;
+	}
+
 	.navbar-search {
 		background-color: var(--blue-400);
 		width: 300px;
@@ -36,6 +44,14 @@
 		}
 	}
 
+	.navbar-toggler {
+		border-color: rgba(255,255,255, 0.1);
+		
+		.icon {
+			stroke: none;
+		}
+	}
+
 
 	svg use {
 		--icon-stroke: white;
diff --git a/frappe/templates/doc.html b/frappe/templates/doc.html
index f3a8ab8cc8..c7b369633a 100644
--- a/frappe/templates/doc.html
+++ b/frappe/templates/doc.html
@@ -30,7 +30,11 @@
 						aria-controls="navbarSupportedContent"
 						aria-expanded="false"
 						aria-label="Toggle navigation">
-						<span class="navbar-toggler-icon"></span>
+						<span>
+							<svg class="icon icon-lg">
+								<use href="#icon-menu"></use>
+							</svg>
+						</span>
 					</button>
 				</div>
 			</div>
diff --git a/frappe/templates/includes/navbar/navbar.html b/frappe/templates/includes/navbar/navbar.html
index 1fb4ae9fb0..41ad55bbd6 100644
--- a/frappe/templates/includes/navbar/navbar.html
+++ b/frappe/templates/includes/navbar/navbar.html
@@ -15,7 +15,11 @@
 			aria-controls="navbarSupportedContent"
 			aria-expanded="false"
 			aria-label="Toggle navigation">
-			<span class="navbar-toggler-icon"></span>
+			<span>
+				<svg class="icon icon-lg">
+					<use href="#icon-menu"></use>
+				</svg>
+			</span>
 		</button>
 
 		<div class="collapse navbar-collapse" id="navbarSupportedContent">
diff --git a/frappe/website/web_template/primary_navbar/primary_navbar.html b/frappe/website/web_template/primary_navbar/primary_navbar.html
index b18ff6e81f..9ff23259eb 100644
--- a/frappe/website/web_template/primary_navbar/primary_navbar.html
+++ b/frappe/website/web_template/primary_navbar/primary_navbar.html
@@ -1,4 +1,4 @@
-<nav class="navbar navbar-primary navbar-expand-lg navbar-dark">
+<nav class="navbar navbar-primary navbar-expand-lg">
 	<div class="container">
 		<a class="navbar-brand" href="{{ url_prefix }}{{ home_page or "/" }}">
 			{%- if brand_html -%}
@@ -15,7 +15,11 @@
 			aria-controls="navbarSupportedContent"
 			aria-expanded="false"
 			aria-label="Toggle navigation">
-			<span class="navbar-toggler-icon"></span>
+			<span>
+				<svg class="icon icon-lg">
+					<use href="#icon-menu"></use>
+				</svg>
+			</span>
 		</button>
 
 		<div class="collapse navbar-collapse" id="navbarSupportedContent">

From 1e9056c0ee9994967d0bd6973dd2d3d6c8110370 Mon Sep 17 00:00:00 2001
From: Shariq Ansari <sharique.rik@gmail.com>
Date: Mon, 18 Oct 2021 20:21:38 +0530
Subject: [PATCH 03/46] fix: Multi level custom report fix

---
 frappe/desk/query_report.py | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/frappe/desk/query_report.py b/frappe/desk/query_report.py
index 9a37d16d0a..1e8298269f 100644
--- a/frappe/desk/query_report.py
+++ b/frappe/desk/query_report.py
@@ -59,6 +59,19 @@ def get_report_doc(report_name):
 	return doc
 
 
+def get_report_result(report, filters):
+	if report.report_type == "Query Report":
+		res = report.execute_query_report(filters)
+
+	elif report.report_type == "Script Report":
+		res = report.execute_script_report(filters)
+
+	elif report.report_type == "Custom Report":
+		ref_report = get_report_doc(report.report_name)
+		res = get_report_result(ref_report, filters)
+
+	return res
+
 def generate_report_result(report, filters=None, user=None, custom_columns=None):
 	user = user or frappe.session.user
 	filters = filters or []
@@ -66,13 +79,7 @@ def generate_report_result(report, filters=None, user=None, custom_columns=None)
 	if filters and isinstance(filters, str):
 		filters = json.loads(filters)
 
-	res = []
-
-	if report.report_type == "Query Report":
-		res = report.execute_query_report(filters)
-
-	elif report.report_type == "Script Report":
-		res = report.execute_script_report(filters)
+	res = get_report_result(report, filters) or []
 
 	columns, result, message, chart, report_summary, skip_total_row = ljust_list(res, 6)
 	columns = [get_column_as_dict(col) for col in columns]

From d7b7afeb1409d5d7045d054e938e7ea7f30e20b8 Mon Sep 17 00:00:00 2001
From: Mohammad Hasnain <hasnain2808@gmail.com>
Date: Tue, 19 Oct 2021 16:18:21 +0530
Subject: [PATCH 04/46] fix: format between for creation/ modified

---
 frappe/model/db_query.py      | 2 +-
 frappe/tests/test_db_query.py | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py
index 978f3062c5..f61f94f660 100644
--- a/frappe/model/db_query.py
+++ b/frappe/model/db_query.py
@@ -492,7 +492,7 @@ class DatabaseQuery(object):
 				f.value = date_range
 				fallback = "'0001-01-01 00:00:00'"
 
-			if (f.fieldname in ('creation', 'modified')):
+			if f.operator in ('>', '<') and (f.fieldname in ('creation', 'modified')):
 				value = cstr(f.value)
 				fallback = "NULL"
 
diff --git a/frappe/tests/test_db_query.py b/frappe/tests/test_db_query.py
index eb2c7b5283..48e97d5bb0 100644
--- a/frappe/tests/test_db_query.py
+++ b/frappe/tests/test_db_query.py
@@ -142,6 +142,12 @@ class TestReportview(unittest.TestCase):
 		self.assertTrue({ "name": event1.name } not in data)
 		self.assertTrue({ "name": event2.name } not in data)
 
+		# test between is formatted for creation column
+		data = DatabaseQuery("Event").execute(
+			filters={"creation": ["between", ["2016-07-06", "2016-07-07"]]},
+			fields=["name"])
+
+
 	def test_ignore_permissions_for_get_filters_cond(self):
 		frappe.set_user('test2@example.com')
 		self.assertRaises(frappe.PermissionError, get_filters_cond, 'DocType', dict(istable=1), [])

From 2a2421888f1cad48f29ca7a3eb2e8ad24e4d015e Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 21 Oct 2021 12:21:51 +0530
Subject: [PATCH 05/46] fix: Check parent permission while doing has_permission
 for child

- Since, permissions for child table is based on parent doctype
---
 frappe/permissions.py | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/frappe/permissions.py b/frappe/permissions.py
index a086c73920..e5055d1f4f 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -34,7 +34,7 @@ def print_has_permission_check_logs(func):
 	return inner
 
 @print_has_permission_check_logs
-def has_permission(doctype, ptype="read", doc=None, verbose=False, user=None, raise_exception=True):
+def has_permission(doctype, ptype="read", doc=None, verbose=False, user=None, raise_exception=True, parent_doctype=None):
 	"""Returns True if user has permission `ptype` for given `doctype`.
 	If `doc` is passed, it also checks user, share and owner permissions.
 
@@ -48,7 +48,11 @@ def has_permission(doctype, ptype="read", doc=None, verbose=False, user=None, ra
 		doctype = doc.doctype
 
 	if frappe.is_table(doctype):
-		return True
+		# use parent doctype to check the permission
+		doctype, doc = get_parent(doctype, doc, parent_doctype)
+		# there's no parent doctype for this is child so deny access!
+		if not doctype:
+			return False
 
 	if user=="Administrator":
 		return True
@@ -559,3 +563,33 @@ def filter_allowed_docs_for_doctype(user_permissions, doctype, with_default_doc=
 def push_perm_check_log(log):
 	if frappe.flags.get('has_permission_check_logs') == None: return
 	frappe.flags.get('has_permission_check_logs').append(_(log))
+
+def get_parent(child_doctype, doc, parent_doctype=None):
+	'''
+		Returns parent doctype/document for a child doctype/document
+		Note: Returns parent doctype incase if there's only one parent doctype for
+		the child doctype that is passed
+
+		TODO: Make this more predictable
+	'''
+	parent_doctype = parent_doctype
+	parent_doc = None
+	if doc:
+		parent_doctype = doc.get("parenttype") \
+			or frappe.get_cached_value(doc.doctype, doc.docname, "parenttype")
+		parent_doc = frappe._dict({
+			"doctype": parent_doctype,
+			"docname": doc.get("parent") \
+				or frappe.get_cached_value(doc.doctype, doc.docname, "parent")
+		})
+	elif not parent_doctype:
+		filters = {"options": child_doctype, "fieldtype": "Table"}
+		table_fields = (frappe.db.get_all('DocField', filters=filters, fields=["parent"], limit=2) +
+			frappe.db.get_all('Custom Field', filters=filters, fields=["parent"],limit=2))
+		if len(table_fields) > 1:
+			# request for parent doctype since there's no other way to find this out
+			frappe.throw(f"There are more than one parents for {child_doctype}. Please specify parent doctype of the child table")
+		else:
+			parent_doctype = table_fields[0].parent if table_fields else None
+
+	return parent_doctype, parent_doc
\ No newline at end of file

From cdde111021bb7538798c5b41a8611694700395ea Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 21 Oct 2021 13:00:52 +0530
Subject: [PATCH 06/46] fix: Re-arrange code

Return true if user is Admin before checking child table condition
---
 frappe/permissions.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/frappe/permissions.py b/frappe/permissions.py
index e5055d1f4f..a7ebc3e9ce 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -47,6 +47,9 @@ def has_permission(doctype, ptype="read", doc=None, verbose=False, user=None, ra
 		doc = doctype
 		doctype = doc.doctype
 
+	if user == "Administrator":
+		return True
+
 	if frappe.is_table(doctype):
 		# use parent doctype to check the permission
 		doctype, doc = get_parent(doctype, doc, parent_doctype)
@@ -54,9 +57,6 @@ def has_permission(doctype, ptype="read", doc=None, verbose=False, user=None, ra
 		if not doctype:
 			return False
 
-	if user=="Administrator":
-		return True
-
 	meta = frappe.get_meta(doctype)
 
 	if doc:
@@ -588,7 +588,7 @@ def get_parent(child_doctype, doc, parent_doctype=None):
 			frappe.db.get_all('Custom Field', filters=filters, fields=["parent"],limit=2))
 		if len(table_fields) > 1:
 			# request for parent doctype since there's no other way to find this out
-			frappe.throw(f"There are more than one parents for {child_doctype}. Please specify parent doctype of the child table")
+			frappe.throw(f"There are more than one parents for {child_doctype}. Please specify parent doctype of the child table.")
 		else:
 			parent_doctype = table_fields[0].parent if table_fields else None
 

From 3728e6dfdb027e5d6e32cc4e571d8ec92fce0045 Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Tue, 26 Oct 2021 12:40:37 +0530
Subject: [PATCH 07/46] fix: Use get_all instead of get_list for doc creation
 to avoid permission check

---
 frappe/contacts/address_and_contact.py             | 4 ++--
 frappe/contacts/doctype/contact/contact.py         | 2 +-
 frappe/core/doctype/communication/communication.py | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/frappe/contacts/address_and_contact.py b/frappe/contacts/address_and_contact.py
index 79c3358665..63643966e3 100644
--- a/frappe/contacts/address_and_contact.py
+++ b/frappe/contacts/address_and_contact.py
@@ -37,13 +37,13 @@ def load_address_and_contact(doc, key=None):
 	contact_list = frappe.get_all("Contact", filters=filters, fields=["*"])
 
 	for contact in contact_list:
-		contact["email_ids"] = frappe.get_list("Contact Email", filters={
+		contact["email_ids"] = frappe.get_all("Contact Email", filters={
 				"parenttype": "Contact",
 				"parent": contact.name,
 				"is_primary": 0
 			}, fields=["email_id"])
 
-		contact["phone_nos"] = frappe.get_list("Contact Phone", filters={
+		contact["phone_nos"] = frappe.get_all("Contact Phone", filters={
 				"parenttype": "Contact",
 				"parent": contact.name,
 				"is_primary_phone": 0,
diff --git a/frappe/contacts/doctype/contact/contact.py b/frappe/contacts/doctype/contact/contact.py
index dfb9ff2973..9152655b85 100644
--- a/frappe/contacts/doctype/contact/contact.py
+++ b/frappe/contacts/doctype/contact/contact.py
@@ -262,7 +262,7 @@ def get_contact_with_phone_number(number):
 	return contacts[0].parent if contacts else None
 
 def get_contact_name(email_id):
-	contact = frappe.get_list("Contact Email", filters={"email_id": email_id}, fields=["parent"], limit=1)
+	contact = frappe.get_all("Contact Email", filters={"email_id": email_id}, fields=["parent"], limit=1)
 	return contact[0].parent if contact else None
 
 def get_contacts_linking_to(doctype, docname, fields=None):
diff --git a/frappe/core/doctype/communication/communication.py b/frappe/core/doctype/communication/communication.py
index bd33189d58..3a78a6a599 100644
--- a/frappe/core/doctype/communication/communication.py
+++ b/frappe/core/doctype/communication/communication.py
@@ -406,7 +406,7 @@ def get_contacts(email_strings, auto_create_contact=False):
 	return contacts
 
 def add_contact_links_to_communication(communication, contact_name):
-	contact_links = frappe.get_list("Dynamic Link", filters={
+	contact_links = frappe.get_all("Dynamic Link", filters={
 			"parenttype": "Contact",
 			"parent": contact_name
 		}, fields=["link_doctype", "link_name"])

From 494cc83bde4e8da18ecf4929d3d69e08f4bf7e2d Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Tue, 26 Oct 2021 14:30:13 +0530
Subject: [PATCH 08/46] fix: Return parent doc object for further permission
 check

---
 frappe/permissions.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/frappe/permissions.py b/frappe/permissions.py
index a7ebc3e9ce..3ad7f87e95 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -577,15 +577,17 @@ def get_parent(child_doctype, doc, parent_doctype=None):
 	if doc:
 		parent_doctype = doc.get("parenttype") \
 			or frappe.get_cached_value(doc.doctype, doc.docname, "parenttype")
-		parent_doc = frappe._dict({
+		parent_doc = frappe.get_cached_doc({
 			"doctype": parent_doctype,
 			"docname": doc.get("parent") \
 				or frappe.get_cached_value(doc.doctype, doc.docname, "parent")
 		})
 	elif not parent_doctype:
 		filters = {"options": child_doctype, "fieldtype": "Table"}
-		table_fields = (frappe.db.get_all('DocField', filters=filters, fields=["parent"], limit=2) +
-			frappe.db.get_all('Custom Field', filters=filters, fields=["parent"],limit=2))
+		options = dict(filters=filters, fields=["parent"], limit=2)
+		table_fields = (frappe.db.get_all('DocField', **options) +
+			frappe.db.get_all('Custom Field', **options))
+
 		if len(table_fields) > 1:
 			# request for parent doctype since there's no other way to find this out
 			frappe.throw(f"There are more than one parents for {child_doctype}. Please specify parent doctype of the child table.")

From 0f98b4d174a901e6d9ef8f18ad90b763716e590d Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Wed, 27 Oct 2021 12:59:42 +0530
Subject: [PATCH 09/46] fix: Make parent_doctype mandatory while accessing
 child doctype

---
 frappe/__init__.py       |  8 ++++---
 frappe/model/db_query.py |  6 ++---
 frappe/permissions.py    | 49 ++++++++++++++++++----------------------
 3 files changed, 30 insertions(+), 33 deletions(-)

diff --git a/frappe/__init__.py b/frappe/__init__.py
index 1b4429d55b..c79970ab61 100644
--- a/frappe/__init__.py
+++ b/frappe/__init__.py
@@ -721,18 +721,20 @@ def only_has_select_perm(doctype, user=None, ignore_permissions=False):
 	else:
 		return False
 
-def has_permission(doctype=None, ptype="read", doc=None, user=None, verbose=False, throw=False):
+def has_permission(doctype=None, ptype="read", doc=None, user=None, verbose=False, throw=False, parent_doctype=None):
 	"""Raises `frappe.PermissionError` if not permitted.
 
 	:param doctype: DocType for which permission is to be check.
 	:param ptype: Permission type (`read`, `write`, `create`, `submit`, `cancel`, `amend`). Default: `read`.
 	:param doc: [optional] Checks User permissions for given doc.
-	:param user: [optional] Check for given user. Default: current user."""
+	:param user: [optional] Check for given user. Default: current user.
+	:param parent_doctype: [optional] Useful while checking permission for child doctype. Default: None"""
 	if not doctype and doc:
 		doctype = doc.doctype
 
 	import frappe.permissions
-	out = frappe.permissions.has_permission(doctype, ptype, doc=doc, verbose=verbose, user=user, raise_exception=throw)
+	out = frappe.permissions.has_permission(doctype, ptype, doc=doc, verbose=verbose, user=user,
+		raise_exception=throw, parent_doctype=parent_doctype)
 	if throw and not out:
 		if doc:
 			frappe.throw(_("No permission for {0}").format(doc.doctype + " " + doc.name))
diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py
index 8f0e0aaefc..08a7e128c8 100644
--- a/frappe/model/db_query.py
+++ b/frappe/model/db_query.py
@@ -35,10 +35,10 @@ class DatabaseQuery(object):
 		join='left join', distinct=False, start=None, page_length=None, limit=None,
 		ignore_ifnull=False, save_user_settings=False, save_user_settings_fields=False,
 		update=None, add_total_row=None, user_settings=None, reference_doctype=None,
-		return_query=False, strict=True, pluck=None, ignore_ddl=False) -> List:
+		return_query=False, strict=True, pluck=None, ignore_ddl=False, parent_doctype=None) -> List:
 		if not ignore_permissions and \
-			not frappe.has_permission(self.doctype, "select", user=user) and \
-			not frappe.has_permission(self.doctype, "read", user=user):
+			not frappe.has_permission(self.doctype, "select", user=user, parent_doctype=parent_doctype) and \
+			not frappe.has_permission(self.doctype, "read", user=user, parent_doctype=parent_doctype):
 
 			frappe.flags.error_message = _('Insufficient Permission for {0}').format(frappe.bold(self.doctype))
 			raise frappe.PermissionError(self.doctype)
diff --git a/frappe/permissions.py b/frappe/permissions.py
index 3ad7f87e95..8faef8edd0 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -51,11 +51,7 @@ def has_permission(doctype, ptype="read", doc=None, verbose=False, user=None, ra
 		return True
 
 	if frappe.is_table(doctype):
-		# use parent doctype to check the permission
-		doctype, doc = get_parent(doctype, doc, parent_doctype)
-		# there's no parent doctype for this is child so deny access!
-		if not doctype:
-			return False
+		return has_child_table_permission(doctype, ptype, doc, parent_doctype)
 
 	meta = frappe.get_meta(doctype)
 
@@ -564,34 +560,33 @@ def push_perm_check_log(log):
 	if frappe.flags.get('has_permission_check_logs') == None: return
 	frappe.flags.get('has_permission_check_logs').append(_(log))
 
-def get_parent(child_doctype, doc, parent_doctype=None):
-	'''
-		Returns parent doctype/document for a child doctype/document
-		Note: Returns parent doctype incase if there's only one parent doctype for
-		the child doctype that is passed
-
-		TODO: Make this more predictable
-	'''
-	parent_doctype = parent_doctype
+def has_child_table_permission(child_doctype, ptype, doc, parent_doctype=None):
 	parent_doc = None
+
 	if doc:
 		parent_doctype = doc.get("parenttype") \
-			or frappe.get_cached_value(doc.doctype, doc.docname, "parenttype")
+			or frappe.get_cached_value(doc.doctype, doc.name, "parent")
+
 		parent_doc = frappe.get_cached_doc({
 			"doctype": parent_doctype,
 			"docname": doc.get("parent") \
-				or frappe.get_cached_value(doc.doctype, doc.docname, "parent")
+				or frappe.get_cached_value(doc.doctype, doc.name, "parent")
 		})
-	elif not parent_doctype:
-		filters = {"options": child_doctype, "fieldtype": "Table"}
-		options = dict(filters=filters, fields=["parent"], limit=2)
-		table_fields = (frappe.db.get_all('DocField', **options) +
-			frappe.db.get_all('Custom Field', **options))
 
-		if len(table_fields) > 1:
-			# request for parent doctype since there's no other way to find this out
-			frappe.throw(f"There are more than one parents for {child_doctype}. Please specify parent doctype of the child table.")
-		else:
-			parent_doctype = table_fields[0].parent if table_fields else None
+	if parent_doctype:
+		if not is_parent_valid(child_doctype, parent_doctype):
+			frappe.throw(f"{parent_doctype} is not a valid parent doctype {child_doctype}")
+	else:
+		frappe.throw(f"Please specify a valid parent doctype for {child_doctype}")
 
-	return parent_doctype, parent_doc
\ No newline at end of file
+	return has_permission(parent_doctype, ptype, parent_doc)
+
+
+def is_parent_valid(child_doctype, parent_doctype):
+	filters = {
+		"options": child_doctype,
+		"fieldtype": "Table",
+		"parent": parent_doctype
+	}
+	return frappe.db.exists("DocField", filters, cache=True) \
+			or frappe.db.exists("Custom Field", filters, cache=True)
\ No newline at end of file

From 68cf640545d4f59c584fa05d09c136c0a6b3a0e5 Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Wed, 27 Oct 2021 13:00:16 +0530
Subject: [PATCH 10/46] test: Test child table permission

---
 frappe/tests/test_permissions.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/frappe/tests/test_permissions.py b/frappe/tests/test_permissions.py
index f4276b2d59..7539e50871 100644
--- a/frappe/tests/test_permissions.py
+++ b/frappe/tests/test_permissions.py
@@ -593,3 +593,9 @@ class TestPermissions(unittest.TestCase):
 
 		# reset the user
 		frappe.set_user(current_user)
+
+	def test_child_table_permissions(self):
+		frappe.set_user("test@example.com")
+		self.assertIsInstance(frappe.get_list("Has Role", parent_doctype="User", limit=1), list)
+		self.assertRaisesRegex(frappe.exceptions.ValidationError, "ToDo is not a valid parent doctype Has Role", frappe.get_list, doctype="Has Role", parent_doctype="ToDo")
+		self.assertRaisesRegex(frappe.exceptions.ValidationError, "Please specify a valid parent doctype for Has Role", frappe.get_list, "Has Role")

From 9189c624370fc3697cb23723f4449d697b51daea Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Wed, 27 Oct 2021 13:52:34 +0530
Subject: [PATCH 11/46] fix: Pass parent_doctype while checking permission for
 child_table in db_query

---
 frappe/model/db_query.py | 3 ++-
 frappe/permissions.py    | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py
index 12bfc95bcb..2d39e0ffa1 100644
--- a/frappe/model/db_query.py
+++ b/frappe/model/db_query.py
@@ -318,7 +318,8 @@ class DatabaseQuery(object):
 		doctype = table_name[4:-1]
 		ptype = 'select' if frappe.only_has_select_perm(doctype) else 'read'
 
-		if not self.flags.ignore_permissions and not frappe.has_permission(doctype, ptype=ptype):
+		if not self.flags.ignore_permissions and \
+			not frappe.has_permission(doctype, ptype=ptype, parent_doctype=self.doctype):
 			frappe.flags.error_message = _('Insufficient Permission for {0}').format(frappe.bold(doctype))
 			raise frappe.PermissionError(doctype)
 
diff --git a/frappe/permissions.py b/frappe/permissions.py
index e3e3c5a57f..d48e7a9dc1 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -589,5 +589,5 @@ def is_parent_valid(child_doctype, parent_doctype):
 		"fieldtype": "Table",
 		"parent": parent_doctype
 	}
-	return frappe.db.exists("DocField", filters, cache=True) \
-			or frappe.db.exists("Custom Field", filters, cache=True)
\ No newline at end of file
+	return not frappe.is_table(parent_doctype) and (frappe.db.exists("DocField", filters, cache=True)
+			or frappe.db.exists("Custom Field", filters, cache=True))
\ No newline at end of file

From 3b92971a8e25e22898f18a38b86bc4421df461b6 Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Wed, 27 Oct 2021 13:53:08 +0530
Subject: [PATCH 12/46] test: Update test case

---
 frappe/tests/test_permissions.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/frappe/tests/test_permissions.py b/frappe/tests/test_permissions.py
index 7539e50871..e6d064a60b 100644
--- a/frappe/tests/test_permissions.py
+++ b/frappe/tests/test_permissions.py
@@ -597,5 +597,9 @@ class TestPermissions(unittest.TestCase):
 	def test_child_table_permissions(self):
 		frappe.set_user("test@example.com")
 		self.assertIsInstance(frappe.get_list("Has Role", parent_doctype="User", limit=1), list)
-		self.assertRaisesRegex(frappe.exceptions.ValidationError, "ToDo is not a valid parent doctype Has Role", frappe.get_list, doctype="Has Role", parent_doctype="ToDo")
-		self.assertRaisesRegex(frappe.exceptions.ValidationError, "Please specify a valid parent doctype for Has Role", frappe.get_list, "Has Role")
+		self.assertRaisesRegex(frappe.exceptions.ValidationError,
+			"ToDo is not a valid parent doctype Has Role", frappe.get_list, doctype="Has Role", parent_doctype="ToDo")
+		self.assertRaisesRegex(frappe.exceptions.ValidationError,
+			"Please specify a valid parent doctype for Has Role", frappe.get_list, "Has Role")
+		self.assertRaisesRegex(frappe.exceptions.ValidationError,
+			"Has Role is not a valid parent doctype Has Role", frappe.get_list, doctype="Has Role", parent_doctype="Has Role")

From b68d6fe8797ae989874a0af03a4006de3d69ff24 Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Wed, 27 Oct 2021 13:57:44 +0530
Subject: [PATCH 13/46] fix: typo

---
 frappe/permissions.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frappe/permissions.py b/frappe/permissions.py
index d48e7a9dc1..8768bcea02 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -566,7 +566,7 @@ def has_child_table_permission(child_doctype, ptype, doc, parent_doctype=None):
 
 	if doc:
 		parent_doctype = doc.get("parenttype") \
-			or frappe.get_cached_value(doc.doctype, doc.name, "parent")
+			or frappe.get_cached_value(doc.doctype, doc.name, "parenttype")
 
 		parent_doc = frappe.get_cached_doc({
 			"doctype": parent_doctype,

From 9ce52fcd18c5b107146ffb246f6af7ba7b885b7a Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 11:17:10 +0530
Subject: [PATCH 14/46] fix: Properly pass kwargs to has_permission of parent

---
 frappe/permissions.py | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/frappe/permissions.py b/frappe/permissions.py
index 8768bcea02..c1483b9b90 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -51,7 +51,8 @@ def has_permission(doctype, ptype="read", doc=None, verbose=False, user=None, ra
 		return True
 
 	if frappe.is_table(doctype):
-		return has_child_table_permission(doctype, ptype, doc, parent_doctype)
+		return has_child_table_permission(doctype, ptype, doc, verbose,
+			user, raise_exception, parent_doctype)
 
 	meta = frappe.get_meta(doctype)
 
@@ -561,26 +562,33 @@ def push_perm_check_log(log):
 	if frappe.flags.get('has_permission_check_logs') == None: return
 	frappe.flags.get('has_permission_check_logs').append(_(log))
 
-def has_child_table_permission(child_doctype, ptype, doc, parent_doctype=None):
+def has_child_table_permission(child_doctype, ptype="read", child_doc=None,
+	verbose=False, user=None, raise_exception=True, parent_doctype=None):
 	parent_doc = None
 
-	if doc:
-		parent_doctype = doc.get("parenttype") \
-			or frappe.get_cached_value(doc.doctype, doc.name, "parenttype")
+	if child_doc:
+		parent_doctype = child_doc.get("parenttype") \
+			or frappe.get_cached_value(child_doc.doctype, child_doc.name, "parenttype")
 
 		parent_doc = frappe.get_cached_doc({
 			"doctype": parent_doctype,
-			"docname": doc.get("parent") \
-				or frappe.get_cached_value(doc.doctype, doc.name, "parent")
+			"docname": child_doc.get("parent") \
+				or frappe.get_cached_value(child_doc.doctype, child_doc.name, "parent")
 		})
 
 	if parent_doctype:
 		if not is_parent_valid(child_doctype, parent_doctype):
-			frappe.throw(f"{parent_doctype} is not a valid parent doctype {child_doctype}")
+			frappe.throw(_("{0} is not a valid parent doctype {1}").format(
+				frappe.bold(parent_doctype),
+				frappe.bold(child_doctype)
+			), title="Invalid Parent DocType")
 	else:
-		frappe.throw(f"Please specify a valid parent doctype for {child_doctype}")
+		frappe.throw(_("Please specify a valid parent doctype for {0}").format(
+			frappe.bold(child_doctype)
+		), title="Parent DocType Required")
 
-	return has_permission(parent_doctype, ptype, parent_doc)
+	return has_permission(parent_doctype, ptype=ptype, doc=parent_doc,
+		verbose=verbose, user=user, raise_exception=raise_exception)
 
 
 def is_parent_valid(child_doctype, parent_doctype):

From 0d5cd864012429876a7195d84bc7da8c56ff1a9f Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 11:18:01 +0530
Subject: [PATCH 15/46] fix: Pass parent_doctype to get_list

---
 frappe/www/list.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/frappe/www/list.py b/frappe/www/list.py
index a45a180220..a9e36fe69f 100644
--- a/frappe/www/list.py
+++ b/frappe/www/list.py
@@ -91,7 +91,7 @@ def get_list_data(doctype, txt=None, limit_start=0, fields=None, cmd=None, limit
 
 	kwargs = dict(doctype=doctype, txt=txt, filters=filters,
 		limit_start=limit_start, limit_page_length=limit,
-		order_by = list_context.order_by or 'modified desc')
+		order_by = list_context.order_by or 'modified desc', parent_doctype=kwargs.get("parent_doctype"))
 
 	# allow guest if flag is set
 	if not list_context.get_list and (list_context.allow_guest or meta.allow_guest_to_view):
@@ -184,7 +184,7 @@ def get_list_context(context, doctype, web_form_name=None):
 	return list_context
 
 def get_list(doctype, txt, filters, limit_start, limit_page_length=20, ignore_permissions=False,
-	fields=None, order_by=None):
+	fields=None, order_by=None, parent_doctype=None):
 	meta = frappe.get_meta(doctype)
 	if not filters:
 		filters = []
@@ -208,5 +208,5 @@ def get_list(doctype, txt, filters, limit_start, limit_page_length=20, ignore_pe
 	return frappe.get_list(doctype, fields = fields,
 		filters=filters, or_filters=or_filters, limit_start=limit_start,
 		limit_page_length = limit_page_length, ignore_permissions=ignore_permissions,
-		order_by=order_by)
+		order_by=order_by, parent_doctype=parent_doctype)
 

From 26dfdf5c116d53459cdf83ae4080f3389e3af8d1 Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 11:18:36 +0530
Subject: [PATCH 16/46] test: Update tests

---
 frappe/tests/test_permissions.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/frappe/tests/test_permissions.py b/frappe/tests/test_permissions.py
index e6d064a60b..9887676f78 100644
--- a/frappe/tests/test_permissions.py
+++ b/frappe/tests/test_permissions.py
@@ -598,8 +598,8 @@ class TestPermissions(unittest.TestCase):
 		frappe.set_user("test@example.com")
 		self.assertIsInstance(frappe.get_list("Has Role", parent_doctype="User", limit=1), list)
 		self.assertRaisesRegex(frappe.exceptions.ValidationError,
-			"ToDo is not a valid parent doctype Has Role", frappe.get_list, doctype="Has Role", parent_doctype="ToDo")
+			".* is not a valid parent doctype .*", frappe.get_list, doctype="Has Role", parent_doctype="ToDo")
 		self.assertRaisesRegex(frappe.exceptions.ValidationError,
-			"Please specify a valid parent doctype for Has Role", frappe.get_list, "Has Role")
+			"Please specify a valid parent doctype for .*", frappe.get_list, "Has Role")
 		self.assertRaisesRegex(frappe.exceptions.ValidationError,
-			"Has Role is not a valid parent doctype Has Role", frappe.get_list, doctype="Has Role", parent_doctype="Has Role")
+			".* is not a valid parent doctype .*", frappe.get_list, doctype="Has Role", parent_doctype="Has Role")

From 95258bf9f229a63ac1e4147665dbdfcf6e5cc9dd Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 13:38:54 +0530
Subject: [PATCH 17/46] fix: Do not allow child table access via
 "get_list_data"

---
 frappe/www/list.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/frappe/www/list.py b/frappe/www/list.py
index a9e36fe69f..715f099f33 100644
--- a/frappe/www/list.py
+++ b/frappe/www/list.py
@@ -72,6 +72,9 @@ def get_list_data(doctype, txt=None, limit_start=0, fields=None, cmd=None, limit
 	"""Returns processed HTML page for a standard listing."""
 	limit_start = cint(limit_start)
 
+	if frappe.is_table(doctype):
+		frappe.throw(_("Child DocTypes are not allowed"), title=_("Invalid DocType"))
+
 	if not txt and frappe.form_dict.search:
 		txt = frappe.form_dict.search
 		del frappe.form_dict['search']
@@ -91,7 +94,7 @@ def get_list_data(doctype, txt=None, limit_start=0, fields=None, cmd=None, limit
 
 	kwargs = dict(doctype=doctype, txt=txt, filters=filters,
 		limit_start=limit_start, limit_page_length=limit,
-		order_by = list_context.order_by or 'modified desc', parent_doctype=kwargs.get("parent_doctype"))
+		order_by = list_context.order_by or 'modified desc')
 
 	# allow guest if flag is set
 	if not list_context.get_list and (list_context.allow_guest or meta.allow_guest_to_view):
@@ -183,8 +186,7 @@ def get_list_context(context, doctype, web_form_name=None):
 
 	return list_context
 
-def get_list(doctype, txt, filters, limit_start, limit_page_length=20, ignore_permissions=False,
-	fields=None, order_by=None, parent_doctype=None):
+def get_list(doctype, txt, filters, limit_start, limit_page_length=20, ignore_permissions=False, fields=None, order_by=None):
 	meta = frappe.get_meta(doctype)
 	if not filters:
 		filters = []
@@ -208,5 +210,5 @@ def get_list(doctype, txt, filters, limit_start, limit_page_length=20, ignore_pe
 	return frappe.get_list(doctype, fields = fields,
 		filters=filters, or_filters=or_filters, limit_start=limit_start,
 		limit_page_length = limit_page_length, ignore_permissions=ignore_permissions,
-		order_by=order_by, parent_doctype=parent_doctype)
+		order_by=order_by)
 

From cb761182682b893d708c79dcd741cedd4e5eb649 Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 13:41:12 +0530
Subject: [PATCH 18/46] refactor: Check parent validity using parent meta

---
 frappe/permissions.py | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/frappe/permissions.py b/frappe/permissions.py
index c1483b9b90..2589893072 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -97,7 +97,7 @@ def has_permission(doctype, ptype="read", doc=None, verbose=False, user=None, ra
 	if not perm:
 		perm = false_if_not_shared()
 
-	return perm
+	return bool(perm)
 
 def get_doc_permissions(doc, user=None, ptype=None):
 	"""Returns a dict of evaluated permissions for given `doc` like `{"read":1, "write":1}`"""
@@ -592,10 +592,7 @@ def has_child_table_permission(child_doctype, ptype="read", child_doc=None,
 
 
 def is_parent_valid(child_doctype, parent_doctype):
-	filters = {
-		"options": child_doctype,
-		"fieldtype": "Table",
-		"parent": parent_doctype
-	}
-	return not frappe.is_table(parent_doctype) and (frappe.db.exists("DocField", filters, cache=True)
-			or frappe.db.exists("Custom Field", filters, cache=True))
\ No newline at end of file
+	from frappe.core.utils import find
+	parent_meta = frappe.get_meta(parent_doctype)
+	child_table_field_exist = find(parent_meta.get_table_fields(), lambda d: d.options == child_doctype)
+	return not frappe.is_table(parent_doctype) and child_table_field_exist
\ No newline at end of file

From 787364b166f6a34e027b5112cc54f15bbb06c9a9 Mon Sep 17 00:00:00 2001
From: Aditya Hase <aditya@adityahase.com>
Date: Thu, 28 Oct 2021 14:16:14 +0530
Subject: [PATCH 19/46] fix(minor): Don't allow changes to global hooks from
 server scripts

---
 frappe/utils/safe_exec.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/frappe/utils/safe_exec.py b/frappe/utils/safe_exec.py
index 4bc4f3e3be..2b8626bee9 100644
--- a/frappe/utils/safe_exec.py
+++ b/frappe/utils/safe_exec.py
@@ -1,4 +1,5 @@
 
+import copy
 import inspect
 import json
 import mimetypes
@@ -129,7 +130,7 @@ def get_safe_globals():
 			make_get_request=frappe.integrations.utils.make_get_request,
 			make_post_request=frappe.integrations.utils.make_post_request,
 			socketio_port=frappe.conf.socketio_port,
-			get_hooks=frappe.get_hooks,
+			get_hooks=get_hooks,
 			sanitize_html=frappe.utils.sanitize_html,
 			log_error=frappe.log_error
 		),
@@ -200,6 +201,10 @@ def cache():
 		hget = frappe.cache().hget
 	)
 
+def get_hooks(hook=None, default=None, app_name=None):
+	hooks = frappe.get_hooks(hook=hook, default=default, app_name=app_name)
+	return copy.deepcopy(hooks)
+
 def read_sql(query, *args, **kwargs):
 	'''a wrapper for frappe.db.sql to allow reads'''
 	query = str(query)

From 7670c0430a91c14adeae1d0e5f3f5f135db4266f Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 14:49:52 +0530
Subject: [PATCH 20/46] fix: Simplify code and fix typo

---
 frappe/permissions.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frappe/permissions.py b/frappe/permissions.py
index 2589893072..7343f4a00e 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -594,5 +594,5 @@ def has_child_table_permission(child_doctype, ptype="read", child_doc=None,
 def is_parent_valid(child_doctype, parent_doctype):
 	from frappe.core.utils import find
 	parent_meta = frappe.get_meta(parent_doctype)
-	child_table_field_exist = find(parent_meta.get_table_fields(), lambda d: d.options == child_doctype)
-	return not frappe.is_table(parent_doctype) and child_table_field_exist
\ No newline at end of file
+	child_table_field_exists = find(parent_meta.get_table_fields(), lambda d: d.options == child_doctype)
+	return not parent_meta.istable and child_table_field_exists
\ No newline at end of file

From af4ce8156d75739bc9e8827d81cb882770ef9c4e Mon Sep 17 00:00:00 2001
From: Ankush Menat <ankush@frappe.io>
Date: Thu, 28 Oct 2021 15:06:31 +0530
Subject: [PATCH 21/46] fix: remove mutable defaults (#14597)

* fix: mutable defaults

* fix: missing defaults
---
 frappe/__init__.py                          | 12 ++++++++++--
 frappe/core/doctype/data_import/importer.py |  4 +++-
 frappe/desk/form/linked_with.py             |  8 +++++---
 frappe/desk/notifications.py                |  5 +++--
 frappe/desk/reportview.py                   | 18 ++++++++++++------
 frappe/email/email_body.py                  | 12 ++++++++++--
 frappe/email/receive.py                     |  2 +-
 frappe/frappeclient.py                      |  8 ++++++--
 frappe/parallel_test_runner.py              |  4 +++-
 frappe/twofactor.py                         |  6 +++---
 10 files changed, 56 insertions(+), 23 deletions(-)

diff --git a/frappe/__init__.py b/frappe/__init__.py
index 9cc83d63a4..b512b23c76 100644
--- a/frappe/__init__.py
+++ b/frappe/__init__.py
@@ -487,11 +487,11 @@ def get_request_header(key, default=None):
 	:param default: Default value."""
 	return request.headers.get(key, default)
 
-def sendmail(recipients=[], sender="", subject="No Subject", message="No Message",
+def sendmail(recipients=None, sender="", subject="No Subject", message="No Message",
 		as_markdown=False, delayed=True, reference_doctype=None, reference_name=None,
 		unsubscribe_method=None, unsubscribe_params=None, unsubscribe_message=None, add_unsubscribe_link=1,
 		attachments=None, content=None, doctype=None, name=None, reply_to=None, queue_separately=False,
-		cc=[], bcc=[], message_id=None, in_reply_to=None, send_after=None, expose_recipients=None,
+		cc=None, bcc=None, message_id=None, in_reply_to=None, send_after=None, expose_recipients=None,
 		send_priority=1, communication=None, retry=1, now=None, read_receipt=None, is_notification=False,
 		inline_images=None, template=None, args=None, header=None, print_letterhead=False, with_container=False):
 	"""Send email using user's default **Email Account** or global default **Email Account**.
@@ -521,6 +521,14 @@ def sendmail(recipients=[], sender="", subject="No Subject", message="No Message
 	:param header: Append header in email
 	:param with_container: Wraps email inside a styled container
 	"""
+
+	if recipients is None:
+		recipients = []
+	if cc is None:
+		cc = []
+	if bcc is None:
+		bcc = []
+
 	text_content = None
 	if template:
 		message, text_content = get_email_from_template(template, args)
diff --git a/frappe/core/doctype/data_import/importer.py b/frappe/core/doctype/data_import/importer.py
index ef2bb02398..cd20a5c0f3 100644
--- a/frappe/core/doctype/data_import/importer.py
+++ b/frappe/core/doctype/data_import/importer.py
@@ -763,7 +763,9 @@ class Column:
 	seen = []
 	fields_column_map = {}
 
-	def __init__(self, index, header, doctype, column_values, map_to_field=None, seen=[]):
+	def __init__(self, index, header, doctype, column_values, map_to_field=None, seen=None):
+		if seen is None:
+			seen = []
 		self.index = index
 		self.column_number = index + 1
 		self.doctype = doctype
diff --git a/frappe/desk/form/linked_with.py b/frappe/desk/form/linked_with.py
index 3aff3877d6..4550fdf0e6 100644
--- a/frappe/desk/form/linked_with.py
+++ b/frappe/desk/form/linked_with.py
@@ -77,7 +77,7 @@ def get_submitted_linked_docs(doctype, name, docs=None, visited=None):
 
 
 @frappe.whitelist()
-def cancel_all_linked_docs(docs, ignore_doctypes_on_cancel_all=[]):
+def cancel_all_linked_docs(docs, ignore_doctypes_on_cancel_all=None):
 	"""
 	Cancel all linked doctype, optionally ignore doctypes specified in a list.
 
@@ -85,6 +85,8 @@ def cancel_all_linked_docs(docs, ignore_doctypes_on_cancel_all=[]):
 		docs (json str) - It contains list of dictionaries of a linked documents.
 		ignore_doctypes_on_cancel_all (list) - List of doctypes to ignore while cancelling.
 	"""
+	if ignore_doctypes_on_cancel_all is None:
+		ignore_doctypes_on_cancel_all = []
 
 	docs = json.loads(docs)
 	if isinstance(ignore_doctypes_on_cancel_all, str):
@@ -96,7 +98,7 @@ def cancel_all_linked_docs(docs, ignore_doctypes_on_cancel_all=[]):
 		frappe.publish_progress(percent=i/len(docs) * 100, title=_("Cancelling documents"))
 
 
-def validate_linked_doc(docinfo, ignore_doctypes_on_cancel_all=[]):
+def validate_linked_doc(docinfo, ignore_doctypes_on_cancel_all=None):
 	"""
 	Validate a document to be submitted and non-exempted from auto-cancel.
 
@@ -109,7 +111,7 @@ def validate_linked_doc(docinfo, ignore_doctypes_on_cancel_all=[]):
 	"""
 
 	#ignore doctype to cancel
-	if docinfo.get("doctype") in ignore_doctypes_on_cancel_all:
+	if docinfo.get("doctype") in (ignore_doctypes_on_cancel_all or []):
 		return False
 
 	# skip non-submittable doctypes since they don't need to be cancelled
diff --git a/frappe/desk/notifications.py b/frappe/desk/notifications.py
index 2a4567ab4f..3fa41790b4 100644
--- a/frappe/desk/notifications.py
+++ b/frappe/desk/notifications.py
@@ -216,7 +216,7 @@ def get_filters_for(doctype):
 
 @frappe.whitelist()
 @frappe.read_only()
-def get_open_count(doctype, name, items=[]):
+def get_open_count(doctype, name, items=None):
 	'''Get open count for given transactions and filters
 
 	:param doctype: Reference DocType
@@ -235,7 +235,8 @@ def get_open_count(doctype, name, items=[]):
 	links = meta.get_dashboard_data()
 
 	# compile all items in a list
-	if not items:
+	if items is None:
+		items = []
 		for group in links.transactions:
 			items.extend(group.get("items"))
 
diff --git a/frappe/desk/reportview.py b/frappe/desk/reportview.py
index 6c9fa2e937..2e30f485c5 100644
--- a/frappe/desk/reportview.py
+++ b/frappe/desk/reportview.py
@@ -214,11 +214,13 @@ def get_parenttype_and_fieldname(field, data):
 
 	return parenttype, fieldname
 
-def compress(data, args = {}):
+def compress(data, args=None):
 	"""separate keys and values"""
 	from frappe.desk.query_report import add_total_row
 
 	if not data: return data
+	if args is None:
+		args = {}
 	values = []
 	keys = list(data[0])
 	for row in data:
@@ -423,15 +425,20 @@ def delete_bulk(doctype, items):
 
 @frappe.whitelist()
 @frappe.read_only()
-def get_sidebar_stats(stats, doctype, filters=[]):
+def get_sidebar_stats(stats, doctype, filters=None):
+	if filters is None:
+		filters = []
 
 	return {"stats": get_stats(stats, doctype, filters)}
 
 @frappe.whitelist()
 @frappe.read_only()
-def get_stats(stats, doctype, filters=[]):
+def get_stats(stats, doctype, filters=None):
 	"""get tag info"""
 	import json
+
+	if filters is None:
+		filters = []
 	tags = json.loads(stats)
 	if filters:
 		filters = json.loads(filters)
@@ -480,12 +487,11 @@ def get_stats(stats, doctype, filters=[]):
 	return stats
 
 @frappe.whitelist()
-def get_filter_dashboard_data(stats, doctype, filters=[]):
+def get_filter_dashboard_data(stats, doctype, filters=None):
 	"""get tags info"""
 	import json
 	tags = json.loads(stats)
-	if filters:
-		filters = json.loads(filters)
+	filters = json.loads(filters or [])
 	stats = {}
 
 	columns = frappe.db.get_table_columns(doctype)
diff --git a/frappe/email/email_body.py b/frappe/email/email_body.py
index 6a32ae6fd9..c25e996bd3 100755
--- a/frappe/email/email_body.py
+++ b/frappe/email/email_body.py
@@ -13,8 +13,8 @@ from email import policy
 
 def get_email(recipients, sender='', msg='', subject='[No Subject]',
 	text_content = None, footer=None, print_html=None, formatted=None, attachments=None,
-	content=None, reply_to=None, cc=[], bcc=[], email_account=None, expose_recipients=None,
-	inline_images=[], header=None):
+	content=None, reply_to=None, cc=None, bcc=None, email_account=None, expose_recipients=None,
+	inline_images=None, header=None):
 	""" Prepare an email with the following format:
 		- multipart/mixed
 			- multipart/alternative
@@ -25,6 +25,14 @@ def get_email(recipients, sender='', msg='', subject='[No Subject]',
 				- attachment
 	"""
 	content = content or msg
+
+	if cc is None:
+		cc = []
+	if bcc is None:
+		bcc = []
+	if inline_images is None:
+		inline_images = []
+
 	emailobj = EMail(sender, recipients, subject, reply_to=reply_to, cc=cc, bcc=bcc, email_account=email_account, expose_recipients=expose_recipients)
 
 	if not content.strip().startswith("<"):
diff --git a/frappe/email/receive.py b/frappe/email/receive.py
index a755ec5e74..7fab90bee3 100644
--- a/frappe/email/receive.py
+++ b/frappe/email/receive.py
@@ -340,7 +340,7 @@ class EmailServer:
 
 		return error_msg
 
-	def update_flag(self, uid_list={}):
+	def update_flag(self, uid_list=None):
 		""" set all uids mails the flag as seen  """
 
 		if not uid_list:
diff --git a/frappe/frappeclient.py b/frappe/frappeclient.py
index e57f82b60a..ab58979203 100644
--- a/frappe/frappeclient.py
+++ b/frappe/frappeclient.py
@@ -286,12 +286,16 @@ class FrappeClient(object):
 		doc.modified = frappe.db.get_single_value(doctype, "modified")
 		frappe.get_doc(doc).insert()
 
-	def get_api(self, method, params={}):
+	def get_api(self, method, params=None):
+		if params is None:
+			params = {}
 		res = self.session.get(self.url + "/api/method/" + method + "/",
 			params=params, verify=self.verify, headers=self.headers)
 		return self.post_process(res)
 
-	def post_api(self, method, params={}):
+	def post_api(self, method, params=None):
+		if params is None:
+			params = {}
 		res = self.session.post(self.url + "/api/method/" + method + "/",
 			params=params, verify=self.verify, headers=self.headers)
 		return self.post_process(res)
diff --git a/frappe/parallel_test_runner.py b/frappe/parallel_test_runner.py
index c7f723bbdc..1a6892d30d 100644
--- a/frappe/parallel_test_runner.py
+++ b/frappe/parallel_test_runner.py
@@ -238,7 +238,9 @@ class ParallelTestWithOrchestrator(ParallelTestRunner):
 		self.call_orchestrator('test-completed')
 		return super().print_result()
 
-	def call_orchestrator(self, endpoint, data={}):
+	def call_orchestrator(self, endpoint, data=None):
+		if data is None:
+			data = {}
 		# add repo token header
 		# build id in header
 		headers = {
diff --git a/frappe/twofactor.py b/frappe/twofactor.py
index 0df4baec50..6ae53ed717 100644
--- a/frappe/twofactor.py
+++ b/frappe/twofactor.py
@@ -11,9 +11,9 @@ from frappe.utils import get_url, get_datetime, time_diff_in_seconds, cint
 
 class ExpiredLoginException(Exception): pass
 
-def toggle_two_factor_auth(state, roles=[]):
+def toggle_two_factor_auth(state, roles=None):
 	'''Enable or disable 2FA in site_config and roles'''
-	for role in roles:
+	for role in roles or []:
 		role = frappe.get_doc('Role', {'role_name': role})
 		role.two_factor_auth = cint(state)
 		role.save(ignore_permissions=True)
@@ -417,4 +417,4 @@ def reset_otp_secret(user):
 		enqueue(method=frappe.sendmail, queue='short', timeout=300, event=None, is_async=True, job_name=None, now=False, **email_args)
 		return frappe.msgprint(_("OTP Secret has been reset. Re-registration will be required on next login."))
 	else:
-		return frappe.throw(_("OTP secret can only be reset by the Administrator."))
\ No newline at end of file
+		return frappe.throw(_("OTP secret can only be reset by the Administrator."))

From bf34de1d0456f4825598cbd3a4946df34ed9b6bf Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 15:06:38 +0530
Subject: [PATCH 22/46] fix: Assume that child doc will have parent references

---
 frappe/permissions.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/frappe/permissions.py b/frappe/permissions.py
index 7343f4a00e..849bc5c7a6 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -567,13 +567,10 @@ def has_child_table_permission(child_doctype, ptype="read", child_doc=None,
 	parent_doc = None
 
 	if child_doc:
-		parent_doctype = child_doc.get("parenttype") \
-			or frappe.get_cached_value(child_doc.doctype, child_doc.name, "parenttype")
-
+		parent_doctype = child_doc.get("parenttype")
 		parent_doc = frappe.get_cached_doc({
 			"doctype": parent_doctype,
-			"docname": child_doc.get("parent") \
-				or frappe.get_cached_value(child_doc.doctype, child_doc.name, "parent")
+			"docname": child_doc.get("parent")
 		})
 
 	if parent_doctype:

From 57df0bad82e8b4a28e17d5897089b1faf0a50022 Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 15:14:53 +0530
Subject: [PATCH 23/46] fix: Check permission for address and contact list

---
 frappe/contacts/address_and_contact.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frappe/contacts/address_and_contact.py b/frappe/contacts/address_and_contact.py
index 63643966e3..7824568a43 100644
--- a/frappe/contacts/address_and_contact.py
+++ b/frappe/contacts/address_and_contact.py
@@ -16,7 +16,7 @@ def load_address_and_contact(doc, key=None):
 		["Dynamic Link", "link_name", "=", doc.name],
 		["Dynamic Link", "parenttype", "=", "Address"],
 	]
-	address_list = frappe.get_all("Address", filters=filters, fields=["*"])
+	address_list = frappe.get_list("Address", filters=filters, fields=["*"])
 
 	address_list = [a.update({"display": get_address_display(a)})
 		for a in address_list]
@@ -34,7 +34,7 @@ def load_address_and_contact(doc, key=None):
 		["Dynamic Link", "link_name", "=", doc.name],
 		["Dynamic Link", "parenttype", "=", "Contact"],
 	]
-	contact_list = frappe.get_all("Contact", filters=filters, fields=["*"])
+	contact_list = frappe.get_list("Contact", filters=filters, fields=["*"])
 
 	for contact in contact_list:
 		contact["email_ids"] = frappe.get_all("Contact Email", filters={

From 4e6ea8fdbd7462f22f8c8188fedee0b19dfebdc2 Mon Sep 17 00:00:00 2001
From: Suraj Shetty <surajshetty3416@gmail.com>
Date: Thu, 28 Oct 2021 15:25:45 +0530
Subject: [PATCH 24/46] fix: Docstring of has_permission & made error title
 translatable - doctype -> DocType - fixed other typo

---
 frappe/__init__.py               | 2 +-
 frappe/permissions.py            | 8 ++++----
 frappe/tests/test_permissions.py | 6 +++---
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/frappe/__init__.py b/frappe/__init__.py
index e43017f71f..ce8bbefe3b 100644
--- a/frappe/__init__.py
+++ b/frappe/__init__.py
@@ -725,7 +725,7 @@ def has_permission(doctype=None, ptype="read", doc=None, user=None, verbose=Fals
 	:param ptype: Permission type (`read`, `write`, `create`, `submit`, `cancel`, `amend`). Default: `read`.
 	:param doc: [optional] Checks User permissions for given doc.
 	:param user: [optional] Check for given user. Default: current user.
-	:param parent_doctype: [optional] Useful while checking permission for child doctype. Default: None"""
+	:param parent_doctype: Required when checking permission for a child DocType (unless doc is specified)."""
 	if not doctype and doc:
 		doctype = doc.doctype
 
diff --git a/frappe/permissions.py b/frappe/permissions.py
index 849bc5c7a6..96e1910462 100644
--- a/frappe/permissions.py
+++ b/frappe/permissions.py
@@ -575,14 +575,14 @@ def has_child_table_permission(child_doctype, ptype="read", child_doc=None,
 
 	if parent_doctype:
 		if not is_parent_valid(child_doctype, parent_doctype):
-			frappe.throw(_("{0} is not a valid parent doctype {1}").format(
+			frappe.throw(_("{0} is not a valid parent DocType for {1}").format(
 				frappe.bold(parent_doctype),
 				frappe.bold(child_doctype)
-			), title="Invalid Parent DocType")
+			), title=_("Invalid Parent DocType"))
 	else:
-		frappe.throw(_("Please specify a valid parent doctype for {0}").format(
+		frappe.throw(_("Please specify a valid parent DocType for {0}").format(
 			frappe.bold(child_doctype)
-		), title="Parent DocType Required")
+		), title=_("Parent DocType Required"))
 
 	return has_permission(parent_doctype, ptype=ptype, doc=parent_doc,
 		verbose=verbose, user=user, raise_exception=raise_exception)
diff --git a/frappe/tests/test_permissions.py b/frappe/tests/test_permissions.py
index 9887676f78..b4e7db9956 100644
--- a/frappe/tests/test_permissions.py
+++ b/frappe/tests/test_permissions.py
@@ -598,8 +598,8 @@ class TestPermissions(unittest.TestCase):
 		frappe.set_user("test@example.com")
 		self.assertIsInstance(frappe.get_list("Has Role", parent_doctype="User", limit=1), list)
 		self.assertRaisesRegex(frappe.exceptions.ValidationError,
-			".* is not a valid parent doctype .*", frappe.get_list, doctype="Has Role", parent_doctype="ToDo")
+			".* is not a valid parent DocType for .*", frappe.get_list, doctype="Has Role", parent_doctype="ToDo")
 		self.assertRaisesRegex(frappe.exceptions.ValidationError,
-			"Please specify a valid parent doctype for .*", frappe.get_list, "Has Role")
+			"Please specify a valid parent DocType for .*", frappe.get_list, "Has Role")
 		self.assertRaisesRegex(frappe.exceptions.ValidationError,
-			".* is not a valid parent doctype .*", frappe.get_list, doctype="Has Role", parent_doctype="Has Role")
+			".* is not a valid parent DocType for .*", frappe.get_list, doctype="Has Role", parent_doctype="Has Role")

From 43a722d3bbfa33b44504592bba701a2908d6cbb2 Mon Sep 17 00:00:00 2001
From: Aditya Hase <aditya@adityahase.com>
Date: Thu, 28 Oct 2021 15:54:32 +0530
Subject: [PATCH 25/46] fix(minor): Don't allow frappe.cache() methods in
 server scripts (#14609)

---
 .../server_script/test_server_script.py       | 21 -------------------
 frappe/utils/safe_exec.py                     | 10 ---------
 2 files changed, 31 deletions(-)

diff --git a/frappe/core/doctype/server_script/test_server_script.py b/frappe/core/doctype/server_script/test_server_script.py
index 100e3c2790..3c091fec0b 100644
--- a/frappe/core/doctype/server_script/test_server_script.py
+++ b/frappe/core/doctype/server_script/test_server_script.py
@@ -69,16 +69,6 @@ frappe.method_that_doesnt_exist("do some magic")
 		disabled = 1,
 		script = '''
 frappe.db.commit()
-'''
-	),
-	dict(
-		name='test_cache_methods',
-		script_type = 'DocType Event',
-		doctype_event = 'Before Save',
-		reference_doctype = 'ToDo',
-		disabled = 1,
-		script = '''
-frappe.cache().set_value('test_key', doc.name)
 '''
 	)
 ]
@@ -149,14 +139,3 @@ class TestServerScript(unittest.TestCase):
 
 		server_script.disabled = 1
 		server_script.save()
-
-	def test_cache_methods_in_server_script(self):
-		server_script = frappe.get_doc('Server Script', 'test_cache_methods')
-		server_script.disabled = 0
-		server_script.save()
-
-		todo = frappe.get_doc(dict(doctype='ToDo', description='test me')).insert()
-		self.assertEqual(todo.name, frappe.cache().get_value('test_key'))
-
-		server_script.disabled = 1
-		server_script.save()
diff --git a/frappe/utils/safe_exec.py b/frappe/utils/safe_exec.py
index 2b8626bee9..cc9662b4eb 100644
--- a/frappe/utils/safe_exec.py
+++ b/frappe/utils/safe_exec.py
@@ -174,8 +174,6 @@ def get_safe_globals():
 			rollback=frappe.db.rollback,
 		)
 
-		out.frappe.cache = cache
-
 	if frappe.response:
 		out.frappe.response = frappe.response
 
@@ -193,14 +191,6 @@ def get_safe_globals():
 
 	return out
 
-def cache():
-	return NamespaceDict(
-		get_value = frappe.cache().get_value,
-		set_value = frappe.cache().set_value,
-		hset = frappe.cache().hset,
-		hget = frappe.cache().hget
-	)
-
 def get_hooks(hook=None, default=None, app_name=None):
 	hooks = frappe.get_hooks(hook=hook, default=default, app_name=app_name)
 	return copy.deepcopy(hooks)

From 6ae352a05f298ff3790b84eed51ddc8f61bd4638 Mon Sep 17 00:00:00 2001
From: rohitwaghchaure <rohitw1991@gmail.com>
Date: Fri, 29 Oct 2021 00:53:57 +0530
Subject: [PATCH 26/46] fix: ignore filename with dotted path  (#14617)

* fix: ignore dotted path in file name

* fix: condition for checking file

* Update data.py

* fix: only allow pdf files

Co-authored-by: Ankush Menat <ankushmenat@gmail.com>
---
 frappe/utils/data.py         | 4 ++++
 frappe/utils/file_manager.py | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/frappe/utils/data.py b/frappe/utils/data.py
index 6e0fb44c4b..f5c46dc184 100644
--- a/frappe/utils/data.py
+++ b/frappe/utils/data.py
@@ -1025,6 +1025,10 @@ def image_to_base64(image, extn):
 
 def pdf_to_base64(filename):
 	from frappe.utils.file_manager import get_file_path
+
+	if '../' in filename or filename.rsplit('.')[-1] not in ['pdf', 'PDF']:
+		return
+
 	file_path = get_file_path(filename)
 	if not file_path:
 		return
diff --git a/frappe/utils/file_manager.py b/frappe/utils/file_manager.py
index 1157ee03b2..56394442f3 100644
--- a/frappe/utils/file_manager.py
+++ b/frappe/utils/file_manager.py
@@ -302,6 +302,9 @@ def get_file(fname):
 
 def get_file_path(file_name):
 	"""Returns file path from given file name"""
+	if '../' in file_name:
+		return
+
 	f = frappe.db.sql("""select file_url from `tabFile`
 		where name=%s or file_name=%s""", (file_name, file_name))
 	if f:

From 7aa8688a094be5c9ef0c3f4b6d1e8129edbb65b9 Mon Sep 17 00:00:00 2001
From: Ankush Menat <ankush@frappe.io>
Date: Mon, 25 Oct 2021 12:48:39 +0530
Subject: [PATCH 27/46] perf: remove "track changes" from log-like doctypes

Removed "Track Changes" from:

- Activity Log
- Error Log
- Error Snapshot
- Scheduled Job Log
- View Log
- Notification Log
- Route History
- Energy Point Log
- Web Page View

These documents dont change and even if they did it's useless to keep
track of it IMO. Removing this speeds up insertion and saves storage.
---
 frappe/core/doctype/activity_log/activity_log.json         | 3 +--
 frappe/core/doctype/error_log/error_log.json               | 5 ++---
 frappe/core/doctype/error_snapshot/error_snapshot.json     | 5 ++---
 .../core/doctype/scheduled_job_log/scheduled_job_log.json  | 5 ++---
 frappe/core/doctype/view_log/view_log.json                 | 5 ++---
 frappe/desk/doctype/notification_log/notification_log.json | 5 ++---
 frappe/desk/doctype/route_history/route_history.json       | 5 ++---
 .../social/doctype/energy_point_log/energy_point_log.json  | 7 +++----
 frappe/website/doctype/web_page_view/web_page_view.json    | 7 +++----
 9 files changed, 19 insertions(+), 28 deletions(-)

diff --git a/frappe/core/doctype/activity_log/activity_log.json b/frappe/core/doctype/activity_log/activity_log.json
index a1ee4dafdb..ad12246a95 100644
--- a/frappe/core/doctype/activity_log/activity_log.json
+++ b/frappe/core/doctype/activity_log/activity_log.json
@@ -154,7 +154,7 @@
  "icon": "fa fa-comment",
  "index_web_pages_for_search": 1,
  "links": [],
- "modified": "2020-08-28 11:43:57.504565",
+ "modified": "2021-10-25 11:43:57.504565",
  "modified_by": "Administrator",
  "module": "Core",
  "name": "Activity Log",
@@ -182,6 +182,5 @@
  "sort_field": "modified",
  "sort_order": "DESC",
  "title_field": "subject",
- "track_changes": 1,
  "track_seen": 1
 }
diff --git a/frappe/core/doctype/error_log/error_log.json b/frappe/core/doctype/error_log/error_log.json
index cdc7a63001..35ca3ceeef 100644
--- a/frappe/core/doctype/error_log/error_log.json
+++ b/frappe/core/doctype/error_log/error_log.json
@@ -112,7 +112,7 @@
  "issingle": 0, 
  "istable": 0, 
  "max_attachments": 0, 
- "modified": "2017-03-14 12:21:44.292471", 
+ "modified": "2021-10-25 12:21:44.292471", 
  "modified_by": "Administrator", 
  "module": "Core", 
  "name": "Error Log", 
@@ -144,6 +144,5 @@
  "read_only_onload": 0, 
  "show_name_in_global_search": 0, 
  "sort_order": "ASC", 
- "track_changes": 1, 
  "track_seen": 0
-}
\ No newline at end of file
+}
diff --git a/frappe/core/doctype/error_snapshot/error_snapshot.json b/frappe/core/doctype/error_snapshot/error_snapshot.json
index ea7a86d4f6..1333fe0d5b 100644
--- a/frappe/core/doctype/error_snapshot/error_snapshot.json
+++ b/frappe/core/doctype/error_snapshot/error_snapshot.json
@@ -359,7 +359,7 @@
  "issingle": 0, 
  "istable": 0, 
  "max_attachments": 0, 
- "modified": "2016-12-29 14:40:38.619106", 
+ "modified": "2021-10-25 14:40:38.619106", 
  "modified_by": "Administrator", 
  "module": "Core", 
  "name": "Error Snapshot", 
@@ -394,6 +394,5 @@
  "sort_field": "timestamp", 
  "sort_order": "DESC", 
  "title_field": "evalue", 
- "track_changes": 1, 
  "track_seen": 0
-}
\ No newline at end of file
+}
diff --git a/frappe/core/doctype/scheduled_job_log/scheduled_job_log.json b/frappe/core/doctype/scheduled_job_log/scheduled_job_log.json
index f86a4c8884..396b32bdf9 100644
--- a/frappe/core/doctype/scheduled_job_log/scheduled_job_log.json
+++ b/frappe/core/doctype/scheduled_job_log/scheduled_job_log.json
@@ -38,7 +38,7 @@
   }
  ],
  "links": [],
- "modified": "2020-01-22 00:00:00.000000",
+ "modified": "2021-10-25 00:00:00.000000",
  "modified_by": "Administrator",
  "module": "Core",
  "name": "Scheduled Job Log",
@@ -59,6 +59,5 @@
  ],
  "quick_entry": 1,
  "sort_field": "modified",
- "sort_order": "DESC",
- "track_changes": 1
+ "sort_order": "DESC"
 }
diff --git a/frappe/core/doctype/view_log/view_log.json b/frappe/core/doctype/view_log/view_log.json
index 6c3247c58f..3c4486c944 100644
--- a/frappe/core/doctype/view_log/view_log.json
+++ b/frappe/core/doctype/view_log/view_log.json
@@ -125,7 +125,7 @@
  "issingle": 0,
  "istable": 0,
  "max_attachments": 0,
- "modified": "2019-09-05 14:22:27.664645",
+ "modified": "2021-10-25 14:22:27.664645",
  "modified_by": "Administrator",
  "module": "Core",
  "name": "View Log",
@@ -158,7 +158,6 @@
  "show_name_in_global_search": 0,
  "sort_field": "modified",
  "sort_order": "DESC",
- "track_changes": 1,
  "track_seen": 0,
  "track_views": 0
-}
\ No newline at end of file
+}
diff --git a/frappe/desk/doctype/notification_log/notification_log.json b/frappe/desk/doctype/notification_log/notification_log.json
index 9e802298e3..e188708277 100644
--- a/frappe/desk/doctype/notification_log/notification_log.json
+++ b/frappe/desk/doctype/notification_log/notification_log.json
@@ -120,7 +120,7 @@
  "hide_toolbar": 1,
  "in_create": 1,
  "links": [],
- "modified": "2020-09-18 17:26:09.703215",
+ "modified": "2021-10-25 17:26:09.703215",
  "modified_by": "Administrator",
  "module": "Desk",
  "name": "Notification Log",
@@ -139,6 +139,5 @@
  "sort_field": "modified",
  "sort_order": "DESC",
  "title_field": "subject",
- "track_changes": 1,
  "track_seen": 1
-}
\ No newline at end of file
+}
diff --git a/frappe/desk/doctype/route_history/route_history.json b/frappe/desk/doctype/route_history/route_history.json
index 7390aa011b..09db2320ca 100644
--- a/frappe/desk/doctype/route_history/route_history.json
+++ b/frappe/desk/doctype/route_history/route_history.json
@@ -88,7 +88,7 @@
  "issingle": 0,
  "istable": 0,
  "max_attachments": 0,
- "modified": "2018-10-05 13:26:03.106050",
+ "modified": "2021-10-25 13:26:03.106050",
  "modified_by": "Administrator",
  "module": "Desk",
  "name": "Route History",
@@ -121,7 +121,6 @@
  "show_name_in_global_search": 0,
  "sort_field": "modified",
  "sort_order": "DESC",
- "track_changes": 1,
  "track_seen": 0,
  "track_views": 0
-}
\ No newline at end of file
+}
diff --git a/frappe/social/doctype/energy_point_log/energy_point_log.json b/frappe/social/doctype/energy_point_log/energy_point_log.json
index 6f5e411a47..8595783d1b 100644
--- a/frappe/social/doctype/energy_point_log/energy_point_log.json
+++ b/frappe/social/doctype/energy_point_log/energy_point_log.json
@@ -112,7 +112,7 @@
  ],
  "index_web_pages_for_search": 1,
  "links": [],
- "modified": "2020-10-06 17:25:40.477044",
+ "modified": "2021-10-25 17:25:40.477044",
  "modified_by": "Administrator",
  "module": "Social",
  "name": "Energy Point Log",
@@ -131,6 +131,5 @@
  ],
  "sort_field": "modified",
  "sort_order": "DESC",
- "title_field": "user",
- "track_changes": 1
-}
\ No newline at end of file
+ "title_field": "user"
+}
diff --git a/frappe/website/doctype/web_page_view/web_page_view.json b/frappe/website/doctype/web_page_view/web_page_view.json
index 4243df39b1..e4b56183d8 100644
--- a/frappe/website/doctype/web_page_view/web_page_view.json
+++ b/frappe/website/doctype/web_page_view/web_page_view.json
@@ -59,7 +59,7 @@
  ],
  "in_create": 1,
  "links": [],
- "modified": "2020-05-05 14:11:24.718770",
+ "modified": "2021-10-25 14:11:24.718770",
  "modified_by": "Administrator",
  "module": "Website",
  "name": "Web Page View",
@@ -82,6 +82,5 @@
  "read_only": 1,
  "sort_field": "modified",
  "sort_order": "DESC",
- "title_field": "path",
- "track_changes": 1
-}
\ No newline at end of file
+ "title_field": "path"
+}

From 7b747a68f905bbc85b955f518a776d17f86f6378 Mon Sep 17 00:00:00 2001
From: Ankush Menat <ankush@frappe.io>
Date: Fri, 29 Oct 2021 12:23:03 +0530
Subject: [PATCH 28/46] fix: disable "track changes" by default

---
 frappe/core/doctype/doctype/doctype.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frappe/core/doctype/doctype/doctype.json b/frappe/core/doctype/doctype/doctype.json
index c85b4e8f67..e18edc1512 100644
--- a/frappe/core/doctype/doctype/doctype.json
+++ b/frappe/core/doctype/doctype/doctype.json
@@ -150,7 +150,7 @@
       "fieldtype": "Column Break"
     },
     {
-      "default": "1",
+      "default": "0",
       "depends_on": "eval:!doc.istable",
       "description": "If enabled, changes to the document are tracked and shown in timeline",
       "fieldname": "track_changes",
@@ -649,7 +649,7 @@
       "link_fieldname": "reference_doctype"
     }
   ],
-  "modified": "2021-09-05 15:39:13.233403",
+  "modified": "2021-10-29 11:39:13.233403",
   "modified_by": "Administrator",
   "module": "Core",
   "name": "DocType",

From 13a2c3403cabbf9391fcd82d6cf97f2c5b8c6b0f Mon Sep 17 00:00:00 2001
From: Ankush Menat <ankush@frappe.io>
Date: Fri, 29 Oct 2021 13:10:28 +0530
Subject: [PATCH 29/46] test: enable scheduler back after running the test

---
 frappe/test_runner.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frappe/test_runner.py b/frappe/test_runner.py
index b6a8145cfb..fa3ef7986e 100644
--- a/frappe/test_runner.py
+++ b/frappe/test_runner.py
@@ -77,6 +77,7 @@ def main(app=None, module=None, doctype=None, verbose=False, tests=(),
 		else:
 			ret = run_all_tests(app, verbose, profile, ui_tests, failfast=failfast, junit_xml_output=junit_xml_output)
 
+		frappe.utils.scheduler.enable_scheduler()
 		if frappe.db: frappe.db.commit()
 
 		# workaround! since there is no separate test db

From 9bf043eddf993d52d2b6af1a20dddcc5e4ee3601 Mon Sep 17 00:00:00 2001
From: Gavin D'souza <gavin18d@gmail.com>
Date: Fri, 29 Oct 2021 13:24:28 +0530
Subject: [PATCH 30/46] fix(db_query): Change fallback to min  datetime

---
 frappe/model/db_query.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py
index e6d0814103..3fba8e3ba3 100644
--- a/frappe/model/db_query.py
+++ b/frappe/model/db_query.py
@@ -490,7 +490,7 @@ class DatabaseQuery(object):
 
 			if f.operator in ('>', '<') and (f.fieldname in ('creation', 'modified')):
 				value = cstr(f.value)
-				fallback = "NULL"
+				fallback = "'0001-01-01 00:00:00'"
 
 			elif f.operator.lower() in ('between') and \
 				(f.fieldname in ('creation', 'modified') or (df and (df.fieldtype=="Date" or df.fieldtype=="Datetime"))):

From ccb53c0f5b746a24d62bf5881d17e2b9b53eee7f Mon Sep 17 00:00:00 2001
From: Gavin D'souza <gavin18d@gmail.com>
Date: Fri, 29 Oct 2021 14:19:28 +0530
Subject: [PATCH 31/46] fix: If column comparision is done, dont check for
 ifnull/coalesce

---
 frappe/model/db_query.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py
index 3fba8e3ba3..6181832363 100644
--- a/frappe/model/db_query.py
+++ b/frappe/model/db_query.py
@@ -545,6 +545,7 @@ class DatabaseQuery(object):
 				fallback = 0
 
 			if isinstance(f.value, Column):
+				can_be_null = False	# added to avoid the ifnull/coalesce addition
 				quote = '"' if frappe.conf.db_type == 'postgres' else "`"
 				value = f"{tname}.{quote}{f.value.name}{quote}"
 

From ebf93fe19b05e80eb0e5f2b0e4676a14aa8a4651 Mon Sep 17 00:00:00 2001
From: Gavin D'souza <gavin18d@gmail.com>
Date: Fri, 29 Oct 2021 14:25:40 +0530
Subject: [PATCH 32/46] chore: Bump browserlist dependency

---
 yarn.lock | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/yarn.lock b/yarn.lock
index 584a56efa7..4843291cef 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -554,9 +554,9 @@ caniuse-api@^3.0.0:
     lodash.uniq "^4.5.0"
 
 caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001109, caniuse-lite@^1.0.30001196, caniuse-lite@^1.0.30001219:
-  version "1.0.30001228"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001228.tgz#bfdc5942cd3326fa51ee0b42fbef4da9d492a7fa"
-  integrity sha512-QQmLOGJ3DEgokHbMSA8cj2a+geXqmnpyOFT0lhQV6P3/YOJvGDEwoedcwxEQ30gJIwIIunHIicunJ2rzK5gB2A==
+  version "1.0.30001272"
+  resolved "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001272.tgz"
+  integrity sha512-DV1j9Oot5dydyH1v28g25KoVm7l8MTxazwuiH3utWiAS6iL/9Nh//TGwqFEeqqN8nnWYQ8HHhUq+o4QPt9kvYw==
 
 caseless@~0.12.0:
   version "0.12.0"
@@ -4934,13 +4934,6 @@ vuedraggable@^2.24.3:
   dependencies:
     sortablejs "1.10.2"
 
-wcwidth@^1.0.1:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/wcwidth/-/wcwidth-1.0.1.tgz#f0b0dcf915bc5ff1528afadb2c0e17b532da2fe8"
-  integrity sha1-8LDc+RW8X/FSivrbLA4XtTLaL+g=
-  dependencies:
-    defaults "^1.0.3"
-
 which-boxed-primitive@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/which-boxed-primitive/-/which-boxed-primitive-1.0.1.tgz#cbe8f838ebe91ba2471bb69e9edbda67ab5a5ec1"

From 4755f416db993c613bd3a2fc824ab382bb4c119a Mon Sep 17 00:00:00 2001
From: Ankush Menat <ankush@frappe.io>
Date: Fri, 29 Oct 2021 15:10:57 +0530
Subject: [PATCH 33/46] test: restore scheduler state after running tests

---
 frappe/test_runner.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/frappe/test_runner.py b/frappe/test_runner.py
index fa3ef7986e..5f26842be2 100644
--- a/frappe/test_runner.py
+++ b/frappe/test_runner.py
@@ -60,7 +60,10 @@ def main(app=None, module=None, doctype=None, verbose=False, tests=(),
 
 		# workaround! since there is no separate test db
 		frappe.clear_cache()
-		frappe.utils.scheduler.disable_scheduler()
+		scheduler_disabled_by_user = frappe.utils.scheduler.is_scheduler_disabled()
+		if not scheduler_disabled_by_user:
+			frappe.utils.scheduler.disable_scheduler()
+
 		set_test_email_config()
 		frappe.conf.update({'bench_id': 'test_bench', 'use_rq_auth': False})
 
@@ -77,7 +80,9 @@ def main(app=None, module=None, doctype=None, verbose=False, tests=(),
 		else:
 			ret = run_all_tests(app, verbose, profile, ui_tests, failfast=failfast, junit_xml_output=junit_xml_output)
 
-		frappe.utils.scheduler.enable_scheduler()
+		if not scheduler_disabled_by_user:
+			frappe.utils.scheduler.enable_scheduler()
+
 		if frappe.db: frappe.db.commit()
 
 		# workaround! since there is no separate test db

From 96ea14003d0eab0d73f5e989abf05afea8b59b35 Mon Sep 17 00:00:00 2001
From: Faris Ansari <netchamp.faris@gmail.com>
Date: Fri, 29 Oct 2021 16:26:45 +0530
Subject: [PATCH 34/46] fix: generate dom id helper for jinja

---
 frappe/utils/jinja_globals.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/frappe/utils/jinja_globals.py b/frappe/utils/jinja_globals.py
index 2e3f9db592..a4f522558b 100644
--- a/frappe/utils/jinja_globals.py
+++ b/frappe/utils/jinja_globals.py
@@ -68,6 +68,13 @@ def web_blocks(blocks):
 	return html
 
 
+def get_dom_id(seed=None):
+	from frappe import generate_hash
+	if not seed:
+		seed = 'DOM'
+	return 'id-' + generate_hash(seed, 12)
+
+
 def include_script(path):
 	path = bundled_asset(path)
 	return f'<script type="text/javascript" src="{path}"></script>'
@@ -94,4 +101,4 @@ def is_rtl(rtl=None):
 	from frappe import local
 	if rtl is None:
 		return local.lang in ["ar", "he", "fa", "ps"]
-	return rtl
\ No newline at end of file
+	return rtl

From 66568e736504c974fd50e7fd0112cdd85679d525 Mon Sep 17 00:00:00 2001
From: Ankush Menat <ankush@frappe.io>
Date: Fri, 29 Oct 2021 21:35:21 +0530
Subject: [PATCH 35/46] fix: old style links in global search

---
 frappe/public/js/frappe/ui/toolbar/search.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frappe/public/js/frappe/ui/toolbar/search.js b/frappe/public/js/frappe/ui/toolbar/search.js
index b5768e0da1..7d262a34d7 100644
--- a/frappe/public/js/frappe/ui/toolbar/search.js
+++ b/frappe/public/js/frappe/ui/toolbar/search.js
@@ -354,7 +354,7 @@ frappe.search.SearchDialog = class {
 	get_link(result) {
 		let link = "";
 		if (result.route) {
-			link = `href="#${result.route.join("/")}"`;
+			link = `href="/app/${result.route.join("/")}"`;
 		} else if (result.data_path) {
 			link = `data-path=${result.data_path}"`;
 		}

From 78705f3a4cae644d10cff415656d83b37b57242a Mon Sep 17 00:00:00 2001
From: Ankush Menat <ankush@frappe.io>
Date: Sun, 31 Oct 2021 18:32:14 +0530
Subject: [PATCH 36/46] fix: patch failure due to new field in doctype

---
 frappe/patches.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frappe/patches.txt b/frappe/patches.txt
index 85df031073..c1b654d0e8 100644
--- a/frappe/patches.txt
+++ b/frappe/patches.txt
@@ -178,6 +178,7 @@ frappe.patches.v13_0.rename_list_view_setting_to_list_view_settings
 frappe.patches.v13_0.remove_twilio_settings
 frappe.patches.v12_0.rename_uploaded_files_with_proper_name
 frappe.patches.v13_0.queryreport_columns
+execute:frappe.reload_doc('core', 'doctype', 'doctype')
 frappe.patches.v13_0.jinja_hook
 frappe.patches.v13_0.update_notification_channel_if_empty
 frappe.patches.v14_0.drop_data_import_legacy

From 2e48c0a85ec99c68b640f4e9c7eea576409a8852 Mon Sep 17 00:00:00 2001
From: Sagar Vora <sagar@resilient.tech>
Date: Sun, 31 Oct 2021 19:20:51 +0530
Subject: [PATCH 37/46] fix: clean `join` param when executing `reportview.get`

---
 frappe/desk/reportview.py | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/frappe/desk/reportview.py b/frappe/desk/reportview.py
index 2e30f485c5..fb150e4bea 100644
--- a/frappe/desk/reportview.py
+++ b/frappe/desk/reportview.py
@@ -180,15 +180,16 @@ def update_wildcard_field_param(data):
 
 
 def clean_params(data):
-	data.pop('cmd', None)
-	data.pop('data', None)
-	data.pop('ignore_permissions', None)
-	data.pop('view', None)
-	data.pop('user', None)
-
-	if "csrf_token" in data:
-		del data["csrf_token"]
-
+	for param in (
+		"cmd",
+		"data",
+		"ignore_permissions",
+		"view",
+		"user",
+		"csrf_token",
+		"join"
+	):
+		data.pop(param, None)
 
 def parse_json(data):
 	if isinstance(data.get("filters"), str):

From 6e57e8b40d37b7a21a4f20028ad4c1f0450458e6 Mon Sep 17 00:00:00 2001
From: Summayya <frappe@Summayyas-MacBook-Air.local>
Date: Sun, 31 Oct 2021 19:41:31 +0530
Subject: [PATCH 38/46] fix(minor): add classes for rtl

---
 frappe/public/js/frappe/form/controls/text_editor.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/frappe/public/js/frappe/form/controls/text_editor.js b/frappe/public/js/frappe/form/controls/text_editor.js
index d1a4e3c8cb..2e36d5ce4c 100644
--- a/frappe/public/js/frappe/form/controls/text_editor.js
+++ b/frappe/public/js/frappe/form/controls/text_editor.js
@@ -55,6 +55,10 @@ Quill.register(FontStyle, true);
 Quill.register(AlignStyle, true);
 Quill.register(DirectionStyle, true);
 
+// direction class
+const DirectionClass = Quill.import('attributors/class/direction');
+Quill.register(DirectionClass,true);
+
 // replace font tag with span
 const Inline = Quill.import('blots/inline');
 

From b3ca6b4068b132e5dfa9d49d7f92bea7de8e3244 Mon Sep 17 00:00:00 2001
From: Summayya Hashmani <58825865+sumaiya2908@users.noreply.github.com>
Date: Sun, 31 Oct 2021 20:09:06 +0530
Subject: [PATCH 39/46] refactor: space in code

---
 frappe/public/js/frappe/form/controls/text_editor.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frappe/public/js/frappe/form/controls/text_editor.js b/frappe/public/js/frappe/form/controls/text_editor.js
index 2e36d5ce4c..f9ee15692c 100644
--- a/frappe/public/js/frappe/form/controls/text_editor.js
+++ b/frappe/public/js/frappe/form/controls/text_editor.js
@@ -57,7 +57,7 @@ Quill.register(DirectionStyle, true);
 
 // direction class
 const DirectionClass = Quill.import('attributors/class/direction');
-Quill.register(DirectionClass,true);
+Quill.register(DirectionClass, true);
 
 // replace font tag with span
 const Inline = Quill.import('blots/inline');

From c5512d4c668d6553e7e2b8e984605fcc1f8f5b58 Mon Sep 17 00:00:00 2001
From: Faris Ansari <netchamp.faris@gmail.com>
Date: Mon, 1 Nov 2021 12:34:24 +0530
Subject: [PATCH 40/46] fix: login as user with browse command

`bench --site site.local browse --user Administrator`
---
 frappe/commands/site.py | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/frappe/commands/site.py b/frappe/commands/site.py
index 2bd3110481..d653c718a3 100755
--- a/frappe/commands/site.py
+++ b/frappe/commands/site.py
@@ -659,10 +659,14 @@ def publish_realtime(context, event, message, room, user, doctype, docname, afte
 
 @click.command('browse')
 @click.argument('site', required=False)
+@click.option('--user', required=False)
 @pass_context
-def browse(context, site):
+def browse(context, site, user=None):
 	'''Opens the site on web browser'''
+	from frappe.auth import LoginManager
+	from frappe.auth import CookieManager
 	import webbrowser
+
 	site = context.sites[0] if context.sites else site
 
 	if not site:
@@ -672,7 +676,20 @@ def browse(context, site):
 	site = site.lower()
 
 	if site in frappe.utils.get_sites():
-		webbrowser.open(frappe.utils.get_site_url(site), new=2)
+		frappe.init(site=site)
+		frappe.connect()
+
+		if user:
+			frappe.utils.set_request(path="/")
+			frappe.local.cookie_manager = CookieManager()
+			frappe.local.login_manager = LoginManager()
+			frappe.local.login_manager.login_as(user)
+			sid = f'/app?sid={frappe.session.sid}'
+		else:
+			sid = ''
+
+		url = f'{frappe.utils.get_site_url(site)}{sid}'
+		webbrowser.open(url, new=2)
 	else:
 		click.echo("\nSite named \033[1m{}\033[0m doesn't exist\n".format(site))
 

From 98fb2ac7873016246a1b381feded55315a550375 Mon Sep 17 00:00:00 2001
From: Lev <mail@vrslev.com>
Date: Mon, 1 Nov 2021 13:39:08 +0300
Subject: [PATCH 41/46] fix(UI): Translate preview popover data (#14842)

---
 frappe/desk/link_preview.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/frappe/desk/link_preview.py b/frappe/desk/link_preview.py
index 9b4471aa8d..03f8368a3a 100644
--- a/frappe/desk/link_preview.py
+++ b/frappe/desk/link_preview.py
@@ -40,6 +40,10 @@ def get_preview_data(doctype, docname):
 
 	for key, val in preview_data.items():
 		if val and meta.has_field(key) and key not in [image_field, title_field, 'name']:
-			formatted_preview_data[meta.get_field(key).label] = frappe.format(val, meta.get_field(key).fieldtype)
+			formatted_preview_data[meta.get_field(key).label] = frappe.format(
+				val,
+				meta.get_field(key).fieldtype,
+				translated=True,
+			)
 
 	return formatted_preview_data

From 4be43092a39331f4d3c8a401416b95853a4d5c86 Mon Sep 17 00:00:00 2001
From: Ankush Menat <ankush@frappe.io>
Date: Mon, 1 Nov 2021 14:43:31 +0530
Subject: [PATCH 42/46] test: flaky sidebar test due to msgprint

---
 cypress/integration/sidebar.js | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/cypress/integration/sidebar.js b/cypress/integration/sidebar.js
index cd771430c6..2831c9bad5 100644
--- a/cypress/integration/sidebar.js
+++ b/cypress/integration/sidebar.js
@@ -17,7 +17,7 @@ context('Sidebar', () => {
 		cy.get('.group-by-item > .dropdown-item').should('contain', 'Me');
 
 		//Assigning a doctype to a user
-		cy.click_listview_row_item(0);
+		cy.visit('/app/doctype/ToDo');
 		cy.get('.form-assignments > .flex > .text-muted').click();
 		cy.get_field('assign_to_me', 'Check').click();
 		cy.get('.modal-footer > .standard-actions > .btn-primary').click();
@@ -44,8 +44,7 @@ context('Sidebar', () => {
 		cy.clear_filters();
 
 		//To remove the assignment
-		cy.visit('/app/doctype');
-		cy.click_listview_row_item(0);
+		cy.visit('/app/doctype/ToDo');
 		cy.get('.assignments > .avatar-group > .avatar > .avatar-frame').click();
 		cy.get('.remove-btn').click({force: true});
 		cy.hide_dialog();
@@ -53,4 +52,4 @@ context('Sidebar', () => {
 		cy.click_sidebar_button("Assigned To");
 		cy.get('.empty-state').should('contain', 'No filters found');
 	});
-});
\ No newline at end of file
+});

From 53a2539c5a848773c633a2dfd495027d5cf52428 Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Tue, 2 Nov 2021 13:24:36 +0530
Subject: [PATCH 43/46] feat(minor): Implement __getitem__ in Base Document
 (#14855) (#14866)

* feat(minor): Implement __getitem__ in Base Document

This addition allows for syntactic sugars like writing doc["name"] to
access document name. This addition is solely for the sake of code
simplicity. Since dictionaries in Python follow this standard, we can
write code that works for both Vanilla Dicts, Frappe Dicts & all
Document objects

* fix: Use getattr over get in getitem

For the sake of consistency and some level of sanity in the universe.

Co-authored-by: Ankush Menat <ankush@frappe.io>

* fix: Raise KeyError instead of AttributeError

why: shit breaks down. Specifically stuff in Jinja templates, attributes
that are conditional. Either this is acceptable or subscripting objects
cannot and probably should not be possible along with our pre-condiitons

* chore: Use hasattr instead of get default

Couldn't decide between a style commit or a chore

Co-authored-by: Ankush Menat <ankush@frappe.io>
(cherry picked from commit 583a7ef23923d362c85beeabe57703c2d5b12a65)

Co-authored-by: gavin <gavin18d@gmail.com>
---
 frappe/model/base_document.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/frappe/model/base_document.py b/frappe/model/base_document.py
index 1826cca9a3..066085a27c 100644
--- a/frappe/model/base_document.py
+++ b/frappe/model/base_document.py
@@ -81,6 +81,9 @@ class BaseDocument(object):
 		if hasattr(self, "__setup__"):
 			self.__setup__()
 
+	def __getitem__(self, key):
+		return self.get(key) if hasattr(self, key) else frappe.throw(msg=key, exc=KeyError)
+
 	@property
 	def meta(self):
 		if not getattr(self, "_meta", None):

From ce695b87065018da067b38ca7c6b15577184ae76 Mon Sep 17 00:00:00 2001
From: Faris Ansari <netchamp.faris@gmail.com>
Date: Tue, 2 Nov 2021 13:38:33 +0530
Subject: [PATCH 44/46] fix: Restrict user logins to developer_mode

- Allow Administrator user login in production
- Print login url
---
 frappe/commands/site.py | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/frappe/commands/site.py b/frappe/commands/site.py
index d653c718a3..c7be995426 100755
--- a/frappe/commands/site.py
+++ b/frappe/commands/site.py
@@ -659,7 +659,7 @@ def publish_realtime(context, event, message, room, user, doctype, docname, afte
 
 @click.command('browse')
 @click.argument('site', required=False)
-@click.option('--user', required=False)
+@click.option('--user', required=False, help='Login as user')
 @pass_context
 def browse(context, site, user=None):
 	'''Opens the site on web browser'''
@@ -679,16 +679,20 @@ def browse(context, site, user=None):
 		frappe.init(site=site)
 		frappe.connect()
 
+		sid = ''
 		if user:
-			frappe.utils.set_request(path="/")
-			frappe.local.cookie_manager = CookieManager()
-			frappe.local.login_manager = LoginManager()
-			frappe.local.login_manager.login_as(user)
-			sid = f'/app?sid={frappe.session.sid}'
-		else:
-			sid = ''
+			if frappe.conf.developer_mode or user == "Administrator":
+				frappe.utils.set_request(path="/")
+				frappe.local.cookie_manager = CookieManager()
+				frappe.local.login_manager = LoginManager()
+				frappe.local.login_manager.login_as(user)
+				sid = f'/app?sid={frappe.session.sid}'
+			else:
+				print("Please enable developer mode to login as a user")
 
 		url = f'{frappe.utils.get_site_url(site)}{sid}'
+		if sid:
+			print(f'Login URL: {url}')
 		webbrowser.open(url, new=2)
 	else:
 		click.echo("\nSite named \033[1m{}\033[0m doesn't exist\n".format(site))

From c75f15e25aaf8ef0227fd5a0a4434ee5f82cb347 Mon Sep 17 00:00:00 2001
From: Faris Ansari <netchamp.faris@gmail.com>
Date: Tue, 2 Nov 2021 13:52:09 +0530
Subject: [PATCH 45/46] fix: print url only when user is Administrator

---
 frappe/commands/site.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frappe/commands/site.py b/frappe/commands/site.py
index c7be995426..27a9e86078 100755
--- a/frappe/commands/site.py
+++ b/frappe/commands/site.py
@@ -691,7 +691,7 @@ def browse(context, site, user=None):
 				print("Please enable developer mode to login as a user")
 
 		url = f'{frappe.utils.get_site_url(site)}{sid}'
-		if sid:
+		if user == "Administrator":
 			print(f'Login URL: {url}')
 		webbrowser.open(url, new=2)
 	else:

From bf0fb0de5c2bf83e293c48186a741917b6a7c031 Mon Sep 17 00:00:00 2001
From: Shariq Ansari <sharique.rik@gmail.com>
Date: Tue, 2 Nov 2021 17:39:14 +0530
Subject: [PATCH 46/46] test: Added UI test for multi level query report

---
 cypress/integration/query_report.js | 50 ++++++++++++++++++++++-------
 1 file changed, 38 insertions(+), 12 deletions(-)

diff --git a/cypress/integration/query_report.js b/cypress/integration/query_report.js
index e2a1c3fc79..9bd542977d 100644
--- a/cypress/integration/query_report.js
+++ b/cypress/integration/query_report.js
@@ -2,32 +2,58 @@ context('Query Report', () => {
 	before(() => {
 		cy.login();
 		cy.visit('/app/website');
+		cy.insert_doc('Report', {
+			'report_name': 'Test ToDo Report',
+			'ref_doctype': 'ToDo',
+			'report_type': 'Query Report',
+			'query': 'select * from tabToDo'
+		}, true).as('doc');
 	});
 
 	it('add custom column in report', () => {
 		cy.visit('/app/query-report/Permitted Documents For User');
 
 		cy.get('.page-form.flex', { timeout: 60000 }).should('have.length', 1).then(() => {
-			cy.get('#page-query-report input[data-fieldname="user"]').as('input');
-			cy.get('@input').focus().type('test@erpnext.com', { delay: 100 }).blur();
+			cy.get('#page-query-report input[data-fieldname="user"]').as('input-user');
+			cy.get('@input-user').focus().type('test@erpnext.com', { delay: 100 }).blur();
 			cy.wait(300);
-			cy.get('#page-query-report input[data-fieldname="doctype"]').as('input-test');
-			cy.get('@input-test').focus().type('Role', { delay: 100 }).blur();
+			cy.get('#page-query-report input[data-fieldname="doctype"]').as('input-role');
+			cy.get('@input-role').focus().type('Role', { delay: 100 }).blur();
 
 			cy.get('.datatable').should('exist');
-			cy.get('.menu-btn-group button').click({ force: true });
-			cy.get('.dropdown-menu li').contains('Add Column').click({ force: true });
-			cy.get('.modal-dialog').should('contain', 'Add Column');
+			cy.get('#page-query-report .page-actions .menu-btn-group button').click({ force: true });
+			cy.get('#page-query-report .menu-btn-group .dropdown-menu').contains('Add Column').click({ force: true });
+			cy.get_open_dialog().get('.modal-title').should('contain', 'Add Column');
 			cy.get('select[data-fieldname="doctype"]').select("Role", { force: true });
 			cy.get('select[data-fieldname="field"]').select("Role Name", { force: true });
 			cy.get('select[data-fieldname="insert_after"]').select("Name", { force: true });
-			cy.get('button').contains('Submit').click({ force: true });
-			cy.get('.menu-btn-group button').click({ force: true });
-			cy.get('.dropdown-menu li').contains('Save').click({ force: true });
-			cy.get('.modal-dialog').should('contain', 'Save Report');
+			cy.get_open_dialog().findByRole('button', {name: 'Submit'}).click({ force: true });
+			cy.get('#page-query-report .page-actions .menu-btn-group button').click({ force: true });
+			cy.get('#page-query-report .menu-btn-group .dropdown-menu').contains('Save').click({ timeout: 100, force: true });
+			cy.get_open_dialog().get('.modal-title').should('contain', 'Save Report');
 
 			cy.get('input[data-fieldname="report_name"]').type("Test Report", { delay: 100, force: true });
-			cy.get('button').contains('Submit').click({ timeout: 1000, force: true });
+			cy.get_open_dialog().findByRole('button', {name: 'Submit'}).click({ timeout: 1000, force: true });
 		});
 	});
+
+	let save_report_and_open = (report, update_name) => {
+		cy.get('#page-query-report .page-actions .menu-btn-group button').click({ force: true });
+		cy.get('#page-query-report .menu-btn-group .dropdown-menu').contains('Save').click({ timeout: 100, force: true });
+		cy.get_open_dialog().get('.modal-title').should('contain', 'Save Report');
+
+		cy.get('input[data-fieldname="report_name"]').type(update_name, { delay: 100, force: true });
+		cy.get_open_dialog().findByRole('button', {name: 'Submit'}).click({ timeout: 1000, force: true });
+
+		cy.visit('/app/query-report/'+report);
+		cy.get('.datatable').should('exist');
+	};
+
+	it('test multi level query report', () => {
+		cy.visit('/app/query-report/Test ToDo Report');
+		cy.get('.datatable').should('exist');
+
+		save_report_and_open('Test ToDo Report 1', ' 1');
+		save_report_and_open('Test ToDo Report 11', '1');
+	});
 });
\ No newline at end of file