vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Merge pull request #8859 from gavindsouza/address-web-from-v12pre

Browse source 
fix(web-forms): view addresses only by session user
This commit is contained in:
gavin 2019-11-25 12:08:08 +05:30 • committed by GitHub
commit f5ed267125
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
frappe/contacts/doctype/address/address.py
View file

@ -145,30 +145,10 @@ def get_list_context(context=None):
def get_address_list(doctype, txt, filters, limit_start, limit_page_length = 20, order_by = None):
from frappe.www.list import get_list
user = frappe.session.user
ignore_permissions = False
if is_website_user():
if not filters: filters = []
add_name = []
contact = frappe.db.sql("""
select
address.name
from
`tabDynamic Link` as link
join
`tabAddress` as address on link.parent = address.name
where
link.parenttype = 'Address' and
link_name in(
select
link.link_name from `tabContact` as contact
join
`tabDynamic Link` as link on contact.name = link.parent
where
contact.user = %s)""",(user))
for c in contact:
add_name.append(c[0])
filters.append(("Address", "name", "in", add_name))
ignore_permissions = True
ignore_permissions = True
if not filters: filters = []
filters.append(("Address", "owner", "=", user))
return get_list(doctype, txt, filters, limit_start, limit_page_length, ignore_permissions=ignore_permissions)