8000 fix: Show authorized private attachments in web forms (backport #32177) by mergify[bot] · Pull Request #32304 · frappe/frappe · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

fix: Show authorized private attachments in web forms (backport #32177) #32304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Apr 25, 2025
Merged

fix: Show authorized private attachments in web forms (backport #32177) #32304

merged 1 commit into from
Apr 25, 2025

Conversation

mergify[bot]
Copy link
Contributor
@mergify mergify bot commented Apr 25, 2025

Issue

  • A website user can only ever see public attachments in a webform even if they have read access to the record and attachments
  • Here is an issue with some public and private attachments
    Screenshot 2025-04-16 at 10 11 41 PM
  • The portal user can only see public attachments because that's hard coded in the web form's context formation logic
    Screenshot 2025-04-16 at 10 12 48 PM

Fix

Assuming "Apply document permissions" is unchecked in the webform

  • The portal user can only see public attachments if they don't have access to the webform doctype via role perms
    2025-04-16 10 15 27 PM
  • The portal user can see both public and private attachments if they have role perm access access to the webform doctype (File permissions are used)
    2025-04-16 10 17 48 PM

Context/Setup:

  • Submitted Web form records are visible only if the web form has login_required checked
  • Use the "Issue" webform for instance: have Login Required, Allow multiple responses, Show attachments and Show list checked
  • Create a Website user with role "Customer" (this user does not have desk access)
  • Have the website user create a bunch of issues via <sitename>/issues/list
  • Have system users add a bunch of private and public attachments to an issue
    This is an automatic backport of pu 8000 ll request fix: Show authorized private attachments in web forms #32177 done by Mergify.

@marination marination merged commit 7673526 into version-15-hotfix Apr 25, 2025
16 checks passed
@marination marination deleted the mergify/bp/version-15-hotfix/pr-32177 branch April 25, 2025 12:57
@frappe-pr-bot
Copy link
Collaborator

🎉 This PR is included in version 15.67.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 14, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees

@marination marination

Labels
released
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@frappe-pr-bot @marination
0