vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

fix: enforce perms on global search

Browse source
This commit is contained in:
Ankush Menat 2023-10-31 21:34:39 +05:30
parent 8d7eac3cb0
commit db01c05eb8
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
frappe/utils/global_search.py
View file

@ -446,7 +446,9 @@ def search(text, start=0, limit=20, doctype=""):
results = []
sorted_results = []
allowed_doctypes = get_doctypes_for_global_search()
allowed_doctypes = set(get_doctypes_for_global_search()) & set(frappe.get_user().get_can_read())
if not allowed_doctypes or (doctype and doctype not in allowed_doctypes):
return []
for word in set(text.split("&")):
word = word.strip()
@ -464,7 +466,7 @@ def search(text, start=0, limit=20, doctype=""):
if doctype:
query = query.where(global_search.doctype == doctype)
elif allowed_doctypes:
else:
query = query.where(global_search.doctype.isin(allowed_doctypes))
if cint(start) > 0: