vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Merge pull request #9926 from surajshetty3416/fix-private-file-access

Browse source 
fix: No access for private files by default
This commit is contained in:
mergify[bot] 2020-04-13 14:19:03 +00:00 • committed by GitHub
commit 8b23bcdf07
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
frappe/core/doctype/file/file.py
View file

@ -517,7 +517,7 @@ class File(Document):
delete_file(self.thumbnail_url)
def is_downloadable(self):
return self.is_private and has_permission(self, 'read')
return has_permission(self, 'read')
def get_extension(self):
'''returns split filename and extension'''
@ -712,7 +712,11 @@ def remove_all(dt, dn, from_delete=False):
def has_permission(doc, ptype=None, user=None):
permission = True
has_access = False
user = user or frappe.session.user
if not doc.is_private or doc.owner == user or user == 'Administrator':
has_access = True
if doc.attached_to_doctype and doc.attached_to_name:
attached_to_doctype = doc.attached_to_doctype
@ -722,20 +726,20 @@ def has_permission(doc, ptype=None, user=None):
ref_doc = frappe.get_doc(attached_to_doctype, attached_to_name)
if ptype in ['write', 'create', 'delete']:
permission = ref_doc.has_permission('write')
has_access = ref_doc.has_permission('write')
if ptype == 'delete' and permission == False:
if ptype == 'delete' and not has_access:
frappe.throw(_("Cannot delete file as it belongs to {0} {1} for which you do not have permissions").format(
doc.attached_to_doctype, doc.attached_to_name),
frappe.PermissionError)
else:
permission = ref_doc.has_permission('read')
has_access = ref_doc.has_permission('read')
except frappe.DoesNotExistError:
# if parent doc is not created before file is created
# we cannot check its permission so allow the file
permission = True
# we cannot check its permission so we will use file's permission
pass
return permission
return has_access
def remove_file_by_url(file_url, doctype=None, name=None):