diff --git a/frappe/permissions.py b/frappe/permissions.py index bec30f87d2..7553cb5dc5 100644 --- a/frappe/permissions.py +++ b/frappe/permissions.py @@ -187,7 +187,9 @@ def get_role_permissions(doctype_meta, user=None): and ptype != 'create'): perms['if_owner'][ptype] = 1 # has no access if not owner - perms[ptype] = 0 + # only provide read access so that user is able to at-least access list + # (and the documents will be filtered based on owner sin further checks) + perms[ptype] = 1 if ptype == 'read' else 0 frappe.local.role_permissions[cache_key] = perms diff --git a/frappe/tests/test_permissions.py b/frappe/tests/test_permissions.py index 6b3638696b..9924e92eda 100644 --- a/frappe/tests/test_permissions.py +++ b/frappe/tests/test_permissions.py @@ -383,7 +383,17 @@ class TestPermissions(unittest.TestCase): update('Blog Post', 'Blogger', 0, 'read', 1) update('Blog Post', 'Blogger', 0, 'write', 1) update('Blog Post', 'Blogger', 0, 'delete', 1) + + # currently test2 user has not created any document + # still he should be able to do get_list query which should + # not raise permission error but simply return empty list + frappe.set_user("test2@example.com") + self.assertEqual(frappe.get_list('Blog Post'), []) + + frappe.set_user("Administrator") + # creates a custom docperm with just read access + # now any user can read any blog post (but other rights are limited to the blog post owner) add_permission('Blog Post', 'Blogger') frappe.clear_cache(doctype="Blog Post")