From c188de894712da59516da16ce17889c352ce7d0f Mon Sep 17 00:00:00 2001 From: Suraj Shetty Date: Mon, 13 Apr 2020 16:10:34 +0530 Subject: [PATCH 1/2] fix: No access for private files by default --- frappe/core/doctype/file/file.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/frappe/core/doctype/file/file.py b/frappe/core/doctype/file/file.py index 6633884bb3..cfad752c1d 100755 --- a/frappe/core/doctype/file/file.py +++ b/frappe/core/doctype/file/file.py @@ -517,7 +517,7 @@ class File(Document): delete_file(self.thumbnail_url) def is_downloadable(self): - return self.is_private and has_permission(self, 'read') + return has_permission(self, 'read') def get_extension(self): '''returns split filename and extension''' @@ -712,7 +712,7 @@ def remove_all(dt, dn, from_delete=False): def has_permission(doc, ptype=None, user=None): - permission = True + permission = False if doc.is_private else True if doc.attached_to_doctype and doc.attached_to_name: attached_to_doctype = doc.attached_to_doctype From 310f32175bf50aab6e6e0682002ff9cf36a872ae Mon Sep 17 00:00:00 2001 From: Suraj Shetty Date: Mon, 13 Apr 2020 17:07:38 +0530 Subject: [PATCH 2/2] fix: Allow private files if owner is accessing --- frappe/core/doctype/file/file.py | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/frappe/core/doctype/file/file.py b/frappe/core/doctype/file/file.py index cfad752c1d..7f763ea9fc 100755 --- a/frappe/core/doctype/file/file.py +++ b/frappe/core/doctype/file/file.py @@ -712,7 +712,11 @@ def remove_all(dt, dn, from_delete=False): def has_permission(doc, ptype=None, user=None): - permission = False if doc.is_private else True + has_access = False + user = user or frappe.session.user + + if not doc.is_private or doc.owner == user or user == 'Administrator': + has_access = True if doc.attached_to_doctype and doc.attached_to_name: attached_to_doctype = doc.attached_to_doctype @@ -722,20 +726,20 @@ def has_permission(doc, ptype=None, user=None): ref_doc = frappe.get_doc(attached_to_doctype, attached_to_name) if ptype in ['write', 'create', 'delete']: - permission = ref_doc.has_permission('write') + has_access = ref_doc.has_permission('write') - if ptype == 'delete' and permission == False: + if ptype == 'delete' and not has_access: frappe.throw(_("Cannot delete file as it belongs to {0} {1} for which you do not have permissions").format( doc.attached_to_doctype, doc.attached_to_name), frappe.PermissionError) else: - permission = ref_doc.has_permission('read') + has_access = ref_doc.has_permission('read') except frappe.DoesNotExistError: # if parent doc is not created before file is created - # we cannot check its permission so allow the file - permission = True + # we cannot check its permission so we will use file's permission + pass - return permission + return has_access def remove_file_by_url(file_url, doctype=None, name=None):