From e0606c9aa03362026ab4ddb23e127f3e15324e67 Mon Sep 17 00:00:00 2001 From: Shankarv19bcr Date: Mon, 26 Jan 2026 15:57:05 +0530 Subject: [PATCH 1/4] feat(file): add DocShare support to file permission checks --- frappe/core/doctype/file/file.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/frappe/core/doctype/file/file.py b/frappe/core/doctype/file/file.py index 3abf1d0c87..4135d9c369 100755 --- a/frappe/core/doctype/file/file.py +++ b/frappe/core/doctype/file/file.py @@ -885,6 +885,16 @@ def has_permission(doc, ptype=None, user=None, debug=False): if user != "Guest" and doc.owner == user: return True + if ( + user != "Guest" + and ptype in ("read", "write", "submit", "share") + and frappe.db.get_all( + "DocShare", + filters={"share_doctype": "File", "share_name": doc.name, ptype: 1}, + or_filters={"user": user, "everyone": 1}, + ) + ): + return True if doc.attached_to_doctype and doc.attached_to_name: attached_to_doctype = doc.attached_to_doctype From 6d79d703a0a0f317e902d90ad72dcd38234127c2 Mon Sep 17 00:00:00 2001 From: Safwan Samsudeen Date: Mon, 23 Feb 2026 11:18:51 +0530 Subject: [PATCH 2/4] fix: use standard method --- frappe/core/doctype/file/file.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/frappe/core/doctype/file/file.py b/frappe/core/doctype/file/file.py index 4135d9c369..dadacb4b5b 100755 --- a/frappe/core/doctype/file/file.py +++ b/frappe/core/doctype/file/file.py @@ -887,12 +887,8 @@ def has_permission(doc, ptype=None, user=None, debug=False): return True if ( user != "Guest" - and ptype in ("read", "write", "submit", "share") - and frappe.db.get_all( - "DocShare", - filters={"share_doctype": "File", "share_name": doc.name, ptype: 1}, - or_filters={"user": user, "everyone": 1}, - ) + and ptype + and frappe.share.get_shared("File", filters=[["share_name", "=", doc.name]], rights=[ptype]) ): return True From a2fdff9006ca426316ba488042b06131f2e3f43f Mon Sep 17 00:00:00 2001 From: Safwan <62411302+safwansamsudeen@users.noreply.github.com> Date: Mon, 23 Feb 2026 14:34:37 +0530 Subject: [PATCH 3/4] fix: pass on user param Co-authored-by: Akhil Narang --- frappe/core/doctype/file/file.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frappe/core/doctype/file/file.py b/frappe/core/doctype/file/file.py index dadacb4b5b..b98c4e3286 100755 --- a/frappe/core/doctype/file/file.py +++ b/frappe/core/doctype/file/file.py @@ -888,7 +888,7 @@ def has_permission(doc, ptype=None, user=None, debug=False): if ( user != "Guest" and ptype - and frappe.share.get_shared("File", filters=[["share_name", "=", doc.name]], rights=[ptype]) + and frappe.share.get_shared("File", filters=[["share_name", "=", doc.name]], rights=[ptype], user=user) ): return True From e15d4c837afdc6fcc6520435defd526e62ec7a0d Mon Sep 17 00:00:00 2001 From: Safwan Samsudeen Date: Mon, 23 Feb 2026 14:45:22 +0530 Subject: [PATCH 4/4] fix: validate ptype in file has_permission --- frappe/core/doctype/file/file.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/frappe/core/doctype/file/file.py b/frappe/core/doctype/file/file.py index b98c4e3286..c0c5445957 100755 --- a/frappe/core/doctype/file/file.py +++ b/frappe/core/doctype/file/file.py @@ -887,8 +887,10 @@ def has_permission(doc, ptype=None, user=None, debug=False): return True if ( user != "Guest" - and ptype - and frappe.share.get_shared("File", filters=[["share_name", "=", doc.name]], rights=[ptype], user=user) + and ptype in ["read", "write", "share", "submit"] + and frappe.share.get_shared( + "File", filters=[["share_name", "=", doc.name]], rights=[ptype], user=user + ) ): return True