vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(apply_field_permissions): improve checks

Browse source 
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
This commit is contained in:
Akhil Narang 2026-03-10 13:43:59 +05:30
parent a655bbdfa6
commit a084bad5d5
No known key found for this signature in database
GPG key ID: 9DCC61E211BF645F
1 changed files with 18 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
frappe/database/query.py
View file

@ -83,7 +83,7 @@ def _apply_date_field_filter_conversion(value, operator: str, doctype: str, fiel
elif isinstance(value, datetime.datetime):
return value.date()
except (AttributeError, TypeError, KeyError):
except AttributeError, TypeError, KeyError:
pass
return value
@ -669,7 +669,7 @@ class Engine:
else:
try:
fallback_value = int(fallback_sql)
except (ValueError, TypeError):
except ValueError, TypeError:
fallback_value = fallback_sql
return operator_fn(_field, ValueWrapper(fallback_value))
@ -698,7 +698,7 @@ class Engine:
else:
try:
fallback_value = int(fallback_sql)
except (ValueError, TypeError):
except ValueError, TypeError:
fallback_value = fallback_sql
if fallback_value == _value:
@ -1432,6 +1432,15 @@ class Engine:
# Skip child table fields if parent permission is only 'select'
continue
if field.parent_fieldname:
parent_meta = frappe.get_meta(self.doctype)
if parent_meta.get_field(
field.parent_fieldname
).permlevel not in parent_meta.get_permlevel_access(
parent_permission_type, user=self.user
):
continue
# Cache permitted fields for child doctypes if accessed multiple times
permitted_child_fields_set = self._get_cached_permitted_fields(
field.doctype,
@ -1462,6 +1471,12 @@ class Engine:
# Skip child queries if parent permission is only 'select'
continue
parent_meta = frappe.get_meta(self.doctype)
if parent_meta.get_field(field.fieldname).permlevel not in parent_meta.get_permlevel_access(
parent_permission_type, user=self.user
):
continue
# Cache permitted fields for the child doctype of the query
permitted_child_fields_set = self._get_cached_permitted_fields(
field.doctype,