diff --git a/frappe/utils/response.py b/frappe/utils/response.py index 8ff5acdff0..79a6b16d1a 100644 --- a/frappe/utils/response.py +++ b/frappe/utils/response.py @@ -224,16 +224,16 @@ def download_private_file(path: str) -> Response: """Checks permissions and sends back private file""" can_access = False - files = frappe.get_all("File", filters={"file_url": path}, pluck="name") + files = frappe.get_all("File", filters={"file_url": path}, fields="*") # this file might be attached to multiple documents # if the file is accessible from any one of those documents # then it should be downloadable - for fname in files: - file: "File" = frappe.get_doc("File", fname) - if can_access := file.is_downloadable(): + for file_data in files: + file: "File" = frappe.get_doc(doctype="File", **file_data) + if file.is_downloadable(): break - if not can_access: + else: raise Forbidden(_("You don't have permission to access this file")) make_access_log(doctype="File", document=file.name, file_type=os.path.splitext(path)[-1][1:])