diff --git a/frappe/database/query.py b/frappe/database/query.py index 73ffc6a25d..1fa09380f3 100644 --- a/frappe/database/query.py +++ b/frappe/database/query.py @@ -1450,6 +1450,16 @@ class Engine: self.query = self.query.where(where_condition) + def get_queried_tables(self) -> list[str]: + """Extract all table names involved in the current query.""" + tables = [] + for table in self.query._from: + tables.append(table.get_sql()) + + for join in self.query._joins: + tables.append(join.item.get_sql()) + return list(set(tables)) + def get_permission_query_conditions(self) -> list["RawCriterion"]: """Add permission query conditions from hooks and server scripts""" from frappe.core.doctype.server_script.server_script_utils import get_server_script_map @@ -1462,6 +1472,14 @@ class Engine: if c := frappe.call(frappe.get_attr(method), self.user, doctype=self.permission_doctype): conditions.append(RawCriterion(f"({c})")) + active_child_tables = [] + current_tables = self.get_queried_tables() + if len(current_tables) > 1: + main_table_name = f"tab{self.doctype}" + for table_name in current_tables: + if table_name != main_table_name: + active_child_tables.append(table_name) + # Get conditions from server scripts if ( permission_script_name := get_server_script_map() @@ -1469,7 +1487,9 @@ class Engine: .get(self.permission_doctype) ): script = frappe.get_doc("Server Script", permission_script_name) - if condition := script.get_permission_query_conditions(self.user): + if condition := script.get_permission_query_conditions( + self.user, active_child_tables=active_child_tables + ): conditions.append(RawCriterion(f"({condition})")) return conditions diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py index c67d6a2aa0..4b07ce0b26 100644 --- a/frappe/model/db_query.py +++ b/frappe/model/db_query.py @@ -1152,8 +1152,10 @@ from {tables} active_child_tables = [] if len(self.tables) > 1: # only if query has multiple tables involved + main_table_name = f"tab{self.doctype}" for table_name in self.tables: - if table_name != f"`tab{self.doctype}`": + clean_name = table_name.replace("`", "").replace('"', "") + if clean_name != main_table_name: active_child_tables.append(table_name) if permission_script_name := get_server_script_map().get("permission_query", {}).get(self.doctype):