Commit graph

180 commits

Author SHA1 Message Date
Ameya Shenoy
f513739d1a
Merge branch 'master' into staging-fixes 2018-11-28 07:53:35 +00:00
Saurabh
4738a9711a fix: tighten protection against sql injection (#6546) 2018-11-28 10:22:30 +05:30
Ameya Shenoy
d1d0edc636
Merge branch 'master' into staging-fixes 2018-11-23 08:07:36 +00:00
rohitwaghchaure
c247ec17ea fix: child table access using get_list function (#6511)
User was able to fetch child table data without having access from client side using frappe.db.get_list function
2018-11-22 12:44:32 +05:30
Ameya Shenoy
5a791cd099
Merge branch 'master' into staging-fixes 2018-11-05 06:37:49 +00:00
Saurabh
856a721073 [fix] sql injection fix (#6390) 2018-11-05 10:51:57 +05:30
Suraj Shetty
15d3f4660e fix(security): pop ignore_permissions arg from whitelisted method 2018-11-05 10:29:50 +05:30
Ameya Shenoy
55fbf7ad99
Merge branch 'master' into staging-fixes 2018-10-31 10:40:55 +00:00
Saurabh
a1e68b6fd5 [fix] potential sql injection by sanitizing fields parameter 2018-10-31 14:26:22 +05:30
sivankar
a48b76b940 refactored code to add support in filters to get descendant or ancest… (#5847)
* refactored code to add support in filters to get descendant or ancestor for tree type documents

* added semicolon and comments to imporve code quality

* refactored code to add not ancestor and not descendants of filters

* added test cases for ancestors of and descendants of

* Translate labels
2018-08-14 12:19:18 +05:30
Saurabh
a135c6c431 resolved merge conflicts 2018-07-06 13:37:51 +05:30
Saurabh
e2b1ebe84c [Security][fix] To avoid possible sql injection via filters and or_filters parameters and tighten the field level checks (#5721)
* [fix] sanitize filters and or_filters to avoid sql injection

* add test cases for filter sanitizer

* codacy fix

* added test cases to test valid scenarios
2018-06-27 09:15:42 +05:30
Saurabh
55eaba90f5 [fix] Sanitize blacklisted functions 2018-05-30 15:25:40 +05:30
Nabin Hait
418d654331
Fixed sanitizing fields for tabDeleted Documents (#5329) 2018-05-30 15:01:12 +05:30
Suraj Shetty
3109123249 Permission improvements (#5494)
* Overwrite "if owner" restriction*
- Overwrite "if owner" restriction if user has other valid roles
(with access rights) without if_owner enabled for it in doc perm
eg:
If a doctype has 2 docperm for Role A and Role B and the docperm with
Role A has  if owner enabled.

Suppose User 1 has Role A, then User 1 should see only docs
which was created by him.

Now if User 2 has Role A and Role B, User 2 should be able to see all the
records because Role B has unrestricted access on doctype.
------------------------------------------------------

Previously in case of User 2, the restriction(of if owner) from Role A
used to reflect and User 2 was only able to view only records made by
him.

This commit will overwrite the if_owner restriction in such case.
- Refactor get_role_permission method

* Add advanced control for user permission
- Add ability to skip user permission check for specific doctype

* Refactor "linked with" method
- Add option to skip linked with doctype which has
ignore_user_permission enabled against them.

* Clear "linked with doctype" cache on doctype changes

* [Minor] Fix formatting

* Fix error and bugs in linked_with method

* Format code

* Add fix to get allowed docs from user_permission

* Fix has_user_permission bug

* Add before migrate patch for user permission

* Fix typo
2018-05-04 13:13:29 +05:30
Suraj Shetty
fb25fdb609 Auto email report fixes (#5410)
* fixes https://github.com/frappe/erpnext/issues/13319

* fixes https://github.com/frappe/erpnext/issues/13422

* change auto email report template

* change auto email report template

* Update data.py

* Update data.py
2018-04-10 10:53:05 +05:30
Suraj Shetty
0be4342649 User permissions redux (#5314)
* [start] removing simpler user permission structure

* permission changes
removed "apply user permission" from has_permission

* test fixes and other supporting fixes

* Removed Apply user permission code

* additional check to see if user has some user permissions related to a doctype

* test fixes

* removed a test

* Permission changes
- Code to restrict access if module is blocked for user.
- [Fix] ignore user perm if applicable

* List view restrictions ui changes

* removed unwanted apply user perm code

* permission (block module fix)

* permission fix

* change user permission
user permission will not be applied if user doesn't have role permission

* removed left "apply_user_permissions" property

* add user permission help template

* perm js refactor

* ui / ux changes
restrict list view before entering view if user is not permitterd
add description for if owner check in role permission manager

* codacy fixes

* permission code fix
add controller permission check
add blocked module check in build_permission

* optimized get blocked module method
2018-04-03 10:42:04 +05:30
Saurabh
676fdc0098 Merge branch 'master' into develop 2018-02-14 11:43:00 +05:30
Saurabh
40d818af90 [hotfix] sanitize fields to avoid mysql injection (#4994)
* [fix] sanitize fields to avoid mysql injection

* sanitize sql statements to avoid subqueries

* Added test cases

* Raise exception if mysql injection found in fields and related test-cases

* [fix] riase exception if blacklistes function or keyworkds found in fields
2018-02-13 14:45:51 +05:30
Rohit Waghchaure
87a0b6213b Merge branch 'master' into develop 2018-01-19 13:06:50 +05:30
rohitwaghchaure
97e18c809e [Fix] Date between filter not working properly on report and listview (#4810) 2018-01-18 15:39:12 +05:30
Faris Ansari
35811df7ef Remove get_count method, use the same db_query method for count (#4736)
* Remove get_count method, use the same db_query method for count

* Revert changes, db_query supported `count(name)` already
2018-01-02 17:55:51 +05:30
Faris Ansari
909234ab9d Listview get_count fix (#4740) 2018-01-02 11:55:49 +05:30
Nabin Hait
3e7a19e3bb
Update db_query.py 2017-11-15 14:05:01 +05:30
Manas Solanki
7031473915 fixed between filters (#4497) 2017-11-15 13:57:53 +05:30
Zlash65
539328f591 between date filter fix 2017-11-01 11:34:18 +05:30
Zlash65
fec63a32f1 test case added for count 2017-10-31 16:14:36 +05:30
Zlash65
2b78da673a better table join and fetch from multiple tables 2017-10-31 16:14:36 +05:30
Zlash65
7d2e30d529 count issue if child table exists in filter fix 2017-10-31 16:14:36 +05:30
Faris Ansari
bc45beb868 Show record count in list header 2017-10-23 20:10:15 +05:30
Faris Ansari
91861c7769 [minor]
- watch js files
- add frappe.db.get_list in js
2017-10-23 17:48:35 +05:30
Rushabh Mehta
5a31e583a2 Merge pull request #3912 from adityahase/fix-raise
Replace Py2 raise syntax with Py 3
2017-08-11 13:01:40 +05:30
Aditya Hase
2da880fc42 Replace Py2 raise syntax with Py 3 2017-08-11 00:38:58 +05:30
Aditya Hase
769338f136 Replaced all instances of basestring with six.string_types 2017-08-11 00:10:11 +05:30
mbauskar
53167626ab resolved merge conflicts 2017-08-02 18:32:30 +05:30
Makarand Bauskar
fc715efdbb [hotfix] fixes for AttributeError: 'NoneType' object has no attribute 'split' (#3840)
* [hotfix] fixes for AttributeError: 'NoneType' object has no attribute 'split'

* [tests] added test cases for not in and in filters
2017-08-02 12:47:10 +05:30
Rushabh Mehta
f609a478ae [refactor] user permissions (#3713)
* [refactor] user permissions

* [fix] tests

* [ux] user-permissions

* [minor] cleanup system settings

* [minor] end progress
2017-07-28 14:33:31 +05:30
Manas Solanki
d0857f8013 Apply User Permissions is being ignored for blank field values (#3496)
* issue where Apply User Permissions is being ignored for blank field values

* configurable settings and added test case

* Update system_settings.json

* save and use locally stored value for strict user permission
2017-07-06 10:48:12 +05:30
tundebabzy
bbde2ec4cf rewrite use of dict.iteritems (#3498)
* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility

* dict.iteritems to six.iteritems(dict) for python3 compatibility
2017-06-19 09:10:21 +05:30
Rushabh Mehta
0a5df4fb4d [debug] show where permission is failing (#3264)
* [debug] show where permission is failing

* [fix] document.py
2017-05-11 11:46:47 +05:30
Rushabh Mehta
262f361021 [minor] ignore permissions option for filters in db_query (#3234) 2017-05-06 12:43:47 +05:30
Makarand Bauskar
8eeda18692 [fixes] minor fix for between operator filter (#3196)
* [fixes] minor fix for between operator filter

* [minor] added a test case for between operator filter
2017-05-01 14:14:04 +05:30
Faris Ansari
95edd73b5b Fix Date between query 2017-04-28 14:43:32 +05:30
Rushabh Mehta
4832c3b50f [fix] missing first column in HTML for auto_email_report 2017-04-26 15:33:59 +05:30
Rushabh Mehta
346bbb008e [fix] ux for auto email report 2017-04-25 12:58:10 +05:30
Nabin Hait
7fe50c885a Merge branch 'master' into develop 2017-03-09 14:59:02 +05:30
Nabin Hait
54af579e09 Merge pull request #2823 from wshurafa/fix-query-condition-case-sensitivity
Fix query condition case sensitivity
2017-03-08 14:03:06 +05:30
Wael AlShurafa
3033aa4d5b Fix condition operator case sensitivity 2017-03-07 21:52:20 +02:00
Faris Ansari
1a76d64781 ListView refactor (#2715)
* [list_settings] save last_view, kanban_board, gantt_mode

* listview.js cleanup

* image_view refactor

* image_view done

* wip

* [photoswipe] wip

* show view for calendar, kanban even if no results

* [gantt_view] refactor into separate file

* [imageview] 3 column border fix

* [imageview] gallery working

* delete old libs

* indentation to tabs

* [gantt] update lib, custom popup html

* custom fontawesome checkbox

* reset gantt state when not permitted

* checkbox styling fix

* working commit

* image, calendar, gantt view working

* more refactoring, kanban view

* minor

* removed old files

* user settings improved

* filters and sort selector de-coupling

* wip

* [imageview] white pswp background

* kanban filters saving fixed

* fixed reportview

* minor

* removed listing.js

* minor fixes and cleanup

* patch for UserSettings table

* patch fix
2017-03-06 11:32:27 +05:30
Nabin Hait
b8bf36e45b Merge branch 'master' into develop 2017-03-02 22:43:21 +05:30