From df846d7518e72f29685dcac158cd22360b5bb64a Mon Sep 17 00:00:00 2001 From: Maxim Sysoev Date: Mon, 1 Sep 2025 14:14:08 +0300 Subject: [PATCH] refactor: enhance permission checks and improve preview data formatting --- frappe/desk/link_preview.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/frappe/desk/link_preview.py b/frappe/desk/link_preview.py index e9861ca52f..57f45f73ca 100644 --- a/frappe/desk/link_preview.py +++ b/frappe/desk/link_preview.py @@ -1,15 +1,16 @@ import frappe from frappe.model import no_value_fields, table_fields from frappe.utils.caching import http_cache -from frappe.www.printview import set_link_titles +from frappe.www.printview import set_title_values_for_link_and_dynamic_link_fields @frappe.whitelist() @http_cache(max_age=60 * 10) def get_preview_data(doctype, docname): + if not frappe.has_permission(doctype, "read", doc=docname): + frappe.throw(frappe._("You don't have permission to view this document"), PermissionError) preview_fields = [] - doc = frappe.get_doc(doctype, docname) - meta = doc.meta + meta = frappe.get_meta(doctype) if not meta.show_preview_popup: return @@ -44,8 +45,9 @@ def get_preview_data(doctype, docname): "preview_title": preview_data.get(title_field), "name": preview_data.get("name"), } - - set_link_titles(doc) + if meta.show_title_field_in_link and meta.title_field: + doc = frappe.get_doc(doctype, docname) + set_title_values_for_link_and_dynamic_link_fields(meta, doc) for key, val in preview_data.items(): if val and meta.has_field(key) and key not in [image_field, title_field, "name"]: