Commit graph

1038 commits

Author SHA1 Message Date
Suraj Shetty
fe49117c92
fix: issue related to quotes (#6682) 2018-12-26 19:36:13 +05:30
Frappe Bot
0499b4a845 Merge branch 'staging' into develop 2018-12-26 12:03:03 +00:00
Suraj Shetty
40fb7ac76f Init reference doctype 2018-12-12 13:50:20 +05:30
Suraj Shetty
039bd58a31 Fix minor bug 2018-12-12 13:17:12 +05:30
Suraj Shetty
70a8054020 Fix client side user permission check 2018-12-12 13:15:11 +05:30
Suraj Shetty
943be440fa Fix user permission check
- show complete list in no user permission for the
 reference doctype is found
2018-12-12 12:58:56 +05:30
Suraj Shetty
390254b65d
Merge branch 'staging-fixes' into staging-fixes 2018-11-29 09:18:43 +05:30
Ameya Shenoy
c5d276b813
Merge branch 'staging' into develop 2018-11-28 08:24:00 +00:00
Ameya Shenoy
f513739d1a
Merge branch 'master' into staging-fixes 2018-11-28 07:53:35 +00:00
Saurabh
4738a9711a fix: tighten protection against sql injection (#6546) 2018-11-28 10:22:30 +05:30
Suraj Shetty
79ddfe6021
Merge branch 'staging-fixes' into staging-fixes 2018-11-26 18:12:34 +05:30
Ameya Shenoy
3669203acf fix(get_version): from hooks.py instaed of git (#6534) 2018-11-26 12:16:12 +01:00
Nabin Hait
e50e6deed3
fix(fetch from): Always set value based on fetch_from if new doc (#6536) 2018-11-26 16:14:58 +05:30
Suraj Shetty
3830e83278 Include Markdown Editor and HTML Editor to data_fieldtype 2018-11-26 13:06:35 +05:30
Ameya Shenoy
13524a1ad5
Merge branch 'staging' into develop 2018-11-23 08:14:29 +00:00
Ameya Shenoy
d1d0edc636
Merge branch 'master' into staging-fixes 2018-11-23 08:07:36 +00:00
Rohit Waghchaure
d8277d0f98 [Fix] Fetch from works after submission of document 2018-11-22 20:10:08 +05:30
Aditya Hase
02d8edd332 [Feature] Markdown Editor (#6383)
* feat(markdown-editor): Add new fieldtype - MarkdownEditor

* feat(markdown-editor): Add MarkdownEditor control

* fix(markdown-editor): Fix placement of "Show Preview" button

* fix(markdown-editor): Render HTML in prints
2018-11-22 11:37:50 +01:00
rohitwaghchaure
c247ec17ea fix: child table access using get_list function (#6511)
User was able to fetch child table data without having access from client side using frappe.db.get_list function
2018-11-22 12:44:32 +05:30
rohitwaghchaure
df6687f9c0 fix: After rename, user still able to search document using old name (#6515) 2018-11-22 11:33:29 +05:30
Suraj Shetty
e79cfc531a Merge branch 'staging-fixes' of https://github.com/frappe/frappe into staging-fixes 2018-11-21 13:18:33 +05:30
Ameya Shenoy
d0e7690ae2
Merge branch 'staging' into develop 2018-11-05 06:48:46 +00:00
Ameya Shenoy
5a791cd099
Merge branch 'master' into staging-fixes 2018-11-05 06:37:49 +00:00
Saurabh
856a721073 [fix] sql injection fix (#6390) 2018-11-05 10:51:57 +05:30
Suraj Shetty
88ba2ecf36 Init return_empty 2018-11-05 10:51:39 +05:30
Suraj Shetty
30de0662e9 Set a boolean to return empty response 2018-11-05 10:39:11 +05:30
Suraj Shetty
15d3f4660e fix(security): pop ignore_permissions arg from whitelisted method 2018-11-05 10:29:50 +05:30
Suraj Shetty
0aee7afb87 Fix permission error while import (#6385)
Custom permission should apply while import
or else import of doctype with custom roles fails
2018-11-02 12:19:25 +05:30
Suraj Shetty
83a17a8242 Fix user permission on link fields 2018-11-01 21:18:15 +05:30
Suraj Shetty
5df1a040ff Remove unwanted code 2018-11-01 21:18:14 +05:30
Suraj Shetty
87d5f87d08 Add applicable_for field 2018-11-01 21:18:14 +05:30
Suraj Shetty
4b3ae8f1ce wip(user_permissions) 2018-11-01 21:17:21 +05:30
Ameya Shenoy
62736ba219
Merge branch 'staging' into develop 2018-10-31 10:58:47 +00:00
Ameya Shenoy
55fbf7ad99
Merge branch 'master' into staging-fixes 2018-10-31 10:40:55 +00:00
Saurabh
a1e68b6fd5 [fix] potential sql injection by sanitizing fields parameter 2018-10-31 14:26:22 +05:30
Ameya Shenoy
742f0d2602
Merge branch 'staging' into develop 2018-10-31 07:29:46 +00:00
Shreya
a4f0316119 fix(series): Revert series count after doc deletion 2018-10-25 14:43:31 +05:30
Ameya Shenoy
63c5613f92
Merge branch 'staging' into develop 2018-10-11 10:11:26 +00:00
Suraj Shetty
e85589f46c HTML Editor control (#6237)
* Add HTML editor

* Add HTML editor map to db_schema.py

* Revert permission change
- ref #6218

* Fix typo

* Add HTML Editor entry to customize form field

* Update customize_form_field.json

* Update permissions.py

* Debounce preview generation

* Translate strings
2018-10-11 14:07:16 +05:30
Ameya Shenoy
387f556dd5
Merge branch 'staging' into develop 2018-10-04 11:41:29 +00:00
Ameya Shenoy
66073c360a
Merge branch 'master' into staging-fixes 2018-10-03 14:51:32 +00:00
rohitwaghchaure
1c8db8fee3 [Fix] Permlevel 1 with read permission fields are not disaplying in the form (#6160) 2018-10-02 10:08:59 +05:30
Suraj Shetty
a380db49a8 Validation fix (#6138)
* Validate set_only_once only on doc update

* Remove redundant error message
2018-09-27 09:16:36 +05:30
Suraj Shetty
e61c9ac40c Fix quote issues (#6143)
* Fix quotes issues

* Escape docname

* Avoid multiple escapes
2018-09-27 09:15:50 +05:30
Faris Ansari
171c650ddf
Merge pull request #6055 from Thunderbottom/file-api
Streamlined File API based on ORM
2018-09-25 17:38:04 +05:30
theopen-institute
ce6446adc2 Add "before_validate" hook to document.py (#6112)
Reference: https://discuss.erpnext.com/t/override-default-validation/20622/5

The addition of a `before_validate` hook makes it possible to override validation methods. This feature has been requested in numerous threads. See:
https://discuss.erpnext.com/t/override-controllers-events/25723/2
https://discuss.erpnext.com/t/is-method-overriding-in-frappe-possible/9225/19
https://discuss.erpnext.com/t/how-to-override-method-in-frappe/28786/8
2018-09-24 12:35:39 +05:30
Chinmay Pai
6e84bbe80d
Merge branch 'develop' into file-api 2018-09-21 13:42:32 +05:30
Chinmay Pai
75c7992557
file-api: add new test, fix minor bugs and code indentation
Signed-off-by: Chinmay Pai <chinmaydpai@gmail.com>
2018-09-21 13:40:25 +05:30
Rushabh Mehta
2e6a202652 Postgres support for Frappe (#5919)
* [start] postgres

* [wip] started refactoring db_schema

* Add psycopg2 to requirements.txt

* Add support for Postgres SQL

- Separate frameworkSQL, database, schema, setup_db file for
mariaDB and postgres
- WIP

* Remove quotes from sql to make it compatible with postgres as well

* Moved some code from db_schema to database.py

* Move code from db_schema to schema.py

Add other required refactoring

* Add schema chages

* Remove redundant code in file

* Add invalid column name exception class to exceptions.py

* Add back tick in query wherever needed and replace ifnull with coalesce

* Update get_column_description code in database.py file

* Remove a print statement

* Add keys to get on_duplicate query

* Add bactick wherever necessary

- Remove db_schema.py file

* Remove DATE_SUB as it is incompatible with postgres

- Fix prepare_filter_condition

* Add backtick and quotes wherever necessary
- Move get_database_size to frappe.db namespace
- fix some left out bugs and errors

* Add code to create key and unique index
- added mysql and posgres in their respective database.py

* Add more bacticks in queries and fix some errors
- Pass keys to on_duplicate_update method
- Replace MONTH with EXTRACT function
- Remove DATEDIFF and CURDATE usage

* Cast state value to int in toggle_two_factor_auth
- since two_factor_auth has the datatype of Int

* Refactor
- Replace Timediff with normal arithmetic operator
- Add MAX_COLUMN_LENGTH
- Remove Redundant code
- Add regexp character constant
- Move create_help_table to database.py
- Add get_full_text_search_condition method
- Inherit MariaDBTable from DBTable

* Replace Database instance with get_db method

* Move db_manager to separate file

* Refactor
- Remove some unwanted code
- Separate alter table code for postgres and mysql
- Replace data_type with column_type in database.py

* Make fulltext search changes in global_search.py

* Add empty string check

* Add root_password to site config

* Create cli command for postgres console

* Move setup of help database to setup_db.py

* Add get_database_list method

* Fix exception handling
- Replace bad_field handler with missing_column handler

* Fix tests and sql queries

* Fix import error

* Fix typo db -> database

* Fix error with make_table in help.py

* Try test for postgres

* Remove pyhton 2.7 version to try postgres travis test

* Add test fixes

* Add db_type to the config of test_site_postgres

* Enable query debug to check the reason for travis fail

* Add backticks to check if the test passes

* Update travis.yml
- Add postgres addon

* Try appending 'd_' to hash for db_name
- since postgres does not support dbname starting with a number

* Try adding db_type for global help to make travis work

* Add print statements to debug travis failure

* Enable transaction and remove debug flag

* Fix help table creation query (postgres)

* Fix import issue

* Add some checks to prevent errors
- Some doctypes used to get called even before they are created

* Try fixes

* Update travis config

* Fix create index for help table

* Remove unused code

* Fix queries and update travis config

* Fix ifnull replace logic (regex)

* Add query fixes and code cleanup

* Fix typo
- get_column_description -> get_table_columns_description

* Fix tests
- Replace double quotes in query with single quote

* Replace psycopg2 with psycopg2-binary to avoid warnings
- http://initd.org/psycopg/docs/install.html#binary-install-from-pypi

* Add multisql api

* Add few multisql queries

* Remove print statements

* Remove get_fulltext_search_condition method and replace with multi query

* Remove text slicing in create user

* Set default for 'values' argument in multisql

* Fix incorrect queries and remove few debug flags
- Fix multisql bug

* Force delete user to fix test
- Fix Import error
- Fix incorrect query

* Fix query builder bug

* Fix bad query

* Fix query (minor)

* Convert boolean text to int since is_private has datatype of int
- Some query changes like removed double quotes
and replace with interpolated string to pass multiple
value pass in one of the query

* Extend database class from an object to support python 2

* Fix query
- Add quotes around value passed to the query for variable comparision

* Try setting host_name for each test site
- To avoid "RemoteDisconnected" error while testing data migration test
- Update travis.yml to add hosts
- Remove unwanted commit in setup_help_database

* Set site hostname to data migration connector (in test file)
- To connect the same site host

* Fix duplicate entry issue
- the problem is in naming series file.
In previous commits I unknowingly changed a part of a series query
due to which series were not getting reset

* Replace few sql queries with orm methods

* Fix codacy

* Fix 'Doctype Sessions not found' issue

* Fix bugs induced during codacy fixes

* Fix Notification Test

- Use ORM instead of raw sql

* Set Date fallback value to 0001-01-01

- 0000-00-00 is invalid date in Postgres
- 0001-01-01 works in both

* Fix date filter method

* Replace double quotes with single quote for literal value

* Remove print statement

* Replace double quotes with single

* Fix tests

- Replace few raw sql with ORM

* Separate query for postgres

- update_fields_to_fetch_query

* Fix tests

- replace locate with strpos for postgres

* Fix tests

- Skip test for datediff
- convert bytes to str in escape method

* Remove TestBot

* Skip fieldname extraction

* Replace docshare raw sql with ORM

* Fix typo

* Fix ancestor query test

* Fix test data migration

* Remove hardcoded hostname

* Add default option and option list for db_type

* Remove frappe.async module

* Remove a debug flag from test

* Fix codacy

* fix import issue

* Convert classmethod to static method

* Convert few instance methods to static methods

* Remove some unused imports

* Fix codacy

- Add exception type
- Replace few instance methods with static methods
- Remove unsued import

* Fix codacy

* Remove unused code

* Remove some unused codes

- Convert some instance methods to static function

* Fix a issue with query modification

* Fix add_index query

* Fix query

* Fix update_auth patch

* Fix a issue with exception handling

* Add try catch to a reload_doc

* Add try-catch to file_manager_hook patch

* import update_gravatar to set_user_gravatar patch

* Undo all the wrong patch fixes

* Fix db_setup code 😪
- previously it was not restoring db from source SQL
which is why few old patched were breaking
(because they were getting different schema structure)

* Fix typo !

* Fix exception(is_missing_column) handling

* Add deleted code
- This code is only used in a erpnext patch.
Can be moved to that patch file

* Fix codacy

* Replace a mariadb specific function in a query used in validate_series

* Remove a debug flag

* Revert changes (rename_parent_and_child)

* Fix validate_one_root method

* Fix date format issue

* Fix codacy
- Disable a pylint for variable argument warning
- Convert an instance method to static method

* Add bandit.yml

The Codacy seems to use Bandit which generates
warning for every subprocess import and its usage during pytest
Since we have carefully used subprocess (avoided user input),
warnings needs to be avoided.
This can be removed if we have any alternative for subprocess usage.

* Skip start_process_with_partial_path check

* Fix typo

* Add python 2.7 test

* Move python versions in travis.yml

* Add python versions to jobs

* Overwrite python version inheritance for postgres in travis.yml

* Add quotes around python version in .travis.yml

* Add quotes around the name of the job

* Try a travis fix

* Try .travis.yml fix

* Import missing subprocess

* Refactor travis.yml

* Refactor travis.yml
- move install and tests commands to separate files
- Use matrix to build combination of python version and db type

* Make install.sh and run-tests.sh executable

* Add sudo required to travis.yml to allow sudo cmmands in shell files

* Load nvm

* Remove verbose flag from scripts

* Remove command-trace-print flag

* Change to build dir in before script

* Add absolute path for scripts

* Fix tests

* Fix typo

* Fix codacy
- fixes - "echo won't expand escape sequences." warning

* Append (_) underscore instead of 'd' for db_name

* Remove printf and use mysql execute flag
2018-09-21 10:20:48 +05:30
Chinmay Pai
5bd66f134d
file-api: add improvements to save() api
file can now be saved by calling save() on the file object instance

Signed-off-by: Chinmay Pai <chinmaydpai@gmail.com>
2018-09-13 09:46:48 +05:30