Commit graph

162 commits

Author SHA1 Message Date
Aarol D'Souza
74f125c360
Revert "fix(client): add stronger checks in save and set_value endpoints" 2026-04-24 20:09:37 +05:30
AarDG10
8825691746 fix(client): add blocklist for save endpoint
These fields are standard and shouldn't be editable through an endpoint. Discarded some of them since they already validate, these don't.
2026-04-23 10:16:43 +05:30
AarDG10
616a17c3ec refactor(client): add stronger checks
Previous code was very passive for dicts., this fixes that by parsing and then checking membership.
2026-04-22 21:13:38 +05:30
Ankush Menat
9e687317a7
fix: Skip nulls in client.get
This makes it consistent with `load.getdoc`
2026-03-30 12:08:28 +05:30
Priyal
aef4d4bfc3 fix: check only select perm instead of read or select 2026-03-17 18:17:38 +05:30
Kaushal Shriwas
dccf136dd4 chore: use appropriate comment for clarity 2026-03-11 15:56:41 +05:30
Kaushal Shriwas
3fd45ad05f fix: enforce link_filters on link fields server-side 2026-03-07 19:51:19 +05:30
Aarol D'Souza
c55ff193a6
fix: add type hints to whitelisted methods 3 (#37149)
* fix(apps): add type hints to whitelisted methods

* fix(recorder): add type hints to whitelisted methods

* fix(comments): add type hints to whitelisted methods

* fix(oauth2): add type hints to whitelisted methods

* fix(google_calendar): add type hints to whitelisted methods

* fix(print): add type hints to whitelisted methods

* fix(print_format_builder): add type hints to whitelisted methods

* refactor(network_printer_settings): remove unused args

* fix(document): add type hints to whitelisted methods

* fix(user_settings): add type hints to whitelisted methods

* fix(mapper): add type hints to whitelisted methods

* fix(connected_app): add type hints to whitelisted methods

* fix(google_contacts): add type hints to whitelisted methods

* fix(frappecloud_billing): add type hints to whitelisted methods

* test: rewrite test to fit the strict type check

* fix(social_login_key): add type hints to whitelisted methods

* fix(share): add type hints to whitelisted methods

* fix(webhook): add type hints to whitelisted methods

* fix(workflow): add type hints to whitelisted methods

* fix(workflow main): add type hints to whitelisted methods

* fix(workflow_action): add type hints to whitelisted methods

* fix: flexible type hint

* fix(client): add type hints to whitelisted methods

* fix: fix some of the tighter types

* fix(frappecloud_billing): add str typehint to whitelisted endpoint

* fix: target_doc can be dict/json string

---------

Co-authored-by: Ankush Menat <ankush@frappe.io>
2026-02-20 06:50:19 +00:00
Sagar Vora
c15a7d5e03 fix: ensure link validation works for translated doctypes with custom queries 2026-01-21 15:17:31 +05:30
Sagar Vora
7d9b8d0832 fix: handle edge case where value may not exist in db 2026-01-10 14:43:23 +05:30
Sagar Vora
e0a3ed5eff fix: validate for virtual fields, assume valid in some cases 2026-01-10 13:56:07 +05:30
Sagar Vora
9fcae2fa45 fix: check for GET request 2026-01-10 13:29:14 +05:30
Sagar Vora
40c7d27e4f fix!: disallow setting link values not matching filters 2026-01-10 13:25:35 +05:30
Akhil Narang
9d32ed49f8
fix: use reportview get_count for client get_count (#35657)
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
2026-01-06 12:33:10 +05:30
Akhil Narang
2dcfe07ca8
refactor: make use of check_permission parameter for get_lazy_doc
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
2025-12-10 16:52:26 +05:30
Sagar Vora
3a3a83b644 refactor: remove redundant child table permission checks
The `check_parent_permission` calls in client.py are redundant because
`frappe.has_permission` already handles child tables via `has_child_permission`,
which performs the same validations plus additional permlevel checks.
2025-12-01 20:37:18 +05:30
Sagar Vora
652cd169de fix(client): pass parent_doctype when fetching fields for child table links 2025-12-01 01:57:03 +05:30
Sumit Bhanushali
f5fed5b4be perf: optimize expand link for table fields 2025-10-27 13:00:43 +05:30
Sumit Bhanushali
f8c73cb254 fix: replace key with object when expand is given in query param 2025-10-15 12:56:23 +05:30
Sumit Bhanushali
36012487f9 fix: updated keys and link response to return full object instead of just title 2025-10-03 15:31:53 +05:30
Sumit Bhanushali
3ad961e8dd feat: support expand links in read_doc, document_list and client.get_list 2025-09-19 10:54:57 +05:30
Ankush Menat
49f582ae57 perf: Use lazy doc in a lot more places 2025-06-11 09:55:45 +05:30
Sagar Vora
83b6231f95 chore: add type hints to whitelisted endpoints 2025-04-21 15:25:55 +05:30
Sagar Vora
5c003b67d9 fix: remove flag to ensure some checks run 2025-03-03 11:53:50 +05:30
Sagar Vora
f4062b4d7a fix: ensure consistent error in response 2025-02-19 12:10:59 +05:30
Ankush Menat
063f2bbc79 fix: only check parent doctype for child doctypes 2025-02-06 13:05:06 +05:30
barredterra
edd4171206 fix: consider parent doctype when validating link to child row 2025-02-05 16:58:43 +01:00
Ankush Menat
5cf5f66fec perf: cache "is_document_amended"
A document that is amended from something stays amended.
2025-01-24 18:58:39 +05:30
Ankush Menat
1470ad2a66 perf: Cache plain link validation for 30 minutes
Very often you're picking same documents again and again, there's no
need to validate them.

Also, document is JUST selected using search_link, so it's 99%
guaranteed to be valid.

The real purpose of this function is to provide "fetch from" feature,
not link validation like the name suggests.

It will get validated server side anyway.
2025-01-24 18:58:36 +05:30
David Arnold
8cfeb156df
devx: add deprecation dumpster (#27887)
* feat: Add deprecation_dumpster.py file

* docs: add jovial and jocose docstring for frappe/deprecation_dumpster.py

* refactor: fill the dumpster with its own kind

* refactor: move to the deprecation dumpster

* chore: color coding class

* fix: only check import error when import errors
2024-10-08 18:56:10 +02:00
Hussain Nagaria
caae0bacc9 docs: add missing full stop 2023-12-18 19:09:45 +05:30
Hussain Nagaria
8d2137c265 docs: consistent doc strings 2023-12-18 18:27:39 +05:30
Md Hussain Nagaria
cfc781e5b6
fix(Virtual DocType): don't call db get_value in link field validation (#23620)
* fix(Virtual DocType): use get_doc to validate link field instead of db get_value

* refactor: use is_virtual_doctype util & always return a dict
2023-12-07 21:58:05 +05:30
rohitwaghchaure
aa0f0d51e7
fix: group by didn't work for the frappe.client.get_value (#22969) 2023-10-30 15:15:56 +05:30
Ankush Menat
824229ce0a refactor: no need to cast bools manually 2023-10-16 18:13:50 +05:30
Ankush Menat
bf037acb5b chore: deprecate get_js
Pointless function for loading public JS files
2023-09-23 15:30:23 +05:30
barredterra
88c8baa9ee refactor: for append to extend, merge list extend
Replace a for append loop with list extend.
Create the list with values instead of creating
an empty list and extending it with another list.
2023-08-09 13:25:39 +02:00
Gavin D'souza
84ccf3d128 fix: Apply field permlevel for doc GET via REST 2023-01-09 15:47:21 +05:30
marination
d6bdd636dc fix: Check Reference Doctype perms & control indicator change
- Don’t change indicator on filter change if user can’t write to board. They can’t save filters
- Invoke `update_order` on Kanban board init() only if user has `write` access to reference doctype (non-deliberate invocation)
- All deliberate invocations of `update_order` via UI actions are blocked/hidden without `write` access
- Remove elements with no access instead of hiding to avoid inspect element hacks
- Card Actions: Block card dragging if no `write` access to reference doctype
- Card Actions: Block card adding  if no `create` access to reference doctype
2022-11-25 12:13:49 +05:30
marination
299831d209 fix: server method to return evaluated dict of perms for a document 2022-11-16 19:24:12 +05:30
Raffael Meyer
09d35c74eb
fix: remove redundant translation (#18775) 2022-11-06 17:27:02 +05:30
Faris Ansari
aa8957e785
fix(insert_many): list instead of set to maintain order (#18641) 2022-10-28 14:37:17 +05:30
Faris Ansari
8acbc38670 fix: raise error if child doc not found 2022-10-18 13:46:57 +05:30
Faris Ansari
55bc60433f fix(frappe.client): delete child doc via parent
so that parent's on_update is called
no change for deletion of normal doctype
2022-10-18 01:23:37 +05:30
Ankush Menat
0686097de2
fix: get single doc using client.get (#17817) 2022-08-13 14:38:06 +05:30
Sagar Vora
ebb0cd13fe
perf: reduce DB call in frappe.client.get (#17665) 2022-08-02 15:38:39 +05:30
Sagar Vora
9a7f92ca1d fix!: allow system managers to toggle email queue 2022-07-18 16:53:49 +00:00
Sagar Vora
6597dedaed
chore!: remove unused APIs from frappe.client (#17446)
chore: remove unused APIs from `frappe.client`
2022-07-08 10:49:39 +05:30
Ankush Menat
81b37cb7d2
refactor: clean up code to py310 supported features (#17367)
refactor: clean up code to py39+ supported syntax

- f-strings instead of format
- latest typing support instead of pre 3.9 TitleCase
- remove UTF-8 declarations.
- many more changes

Powered by https://github.com/asottile/pyupgrade/ + manual cleanups
2022-07-01 11:51:05 +05:30
Sagar Vora
217644ac07
fix!: remove unnecessary get_default API (#17295) 2022-06-27 01:01:03 +05:30