fix: Apply permlevel for update_doc endpoint in v2 API #32135
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Apply Read Permission to returned fields of API v2
gavindsouza
approved these changes
Apr 16, 2025
mergify bot
pushed a commit
that referenced
this pull request
Apr 16, 2025
* fix: Only Return Allowed Fields in API Response Apply Read Permission to the returned fields of API v2 (cherry picked from commit 38f112f)
gavindsouza
added a commit
that referenced
this pull request
Apr 16, 2025
…-32135 fix: Apply permlevel for update_doc endpoint in v2 API (backport #32135)
frappe-pr-bot
pushed a commit
that referenced
this pull request
Apr 22, 2025
# [15.66.0](v15.65.2...v15.66.0) (2025-04-22) ### Bug Fixes * add param `is_system_generated=True` to `make_property_setter` ([86d7395](86d7395)) * add translate to error message ([59df3b0](59df3b0)) * allow custom fonts in wkhtmltopdf ([13e0d5d](13e0d5d)) * Allow to manually send an email even if queue is disabled ([13054b8](13054b8)) * Apply permlevel for update_doc endpoint in v2 API ([#32135](#32135)) ([bccb794](bccb794)) * broken print preview ([3a6f6a5](3a6f6a5)) * **db_query:** improve subquery check ([a640bde](a640bde)) * **db_query:** use `re.DOTALL` ([c6001fe](c6001fe)) * **email_queue:** remove confirm step ([4b73218](4b73218)) * **event:** Better calculation of next recurring event ([a624c02](a624c02)) * **Event:** Capture days within the weekly repeat ([7d70a34](7d70a34)) * **Event:** Handle end of the month repeats ([51053a0](51053a0)) * Exclude perm restrcited fields from standard list view filter ([e81cb9a](e81cb9a)) * **fc-billing:** switch manage billing to a `button` instead of `div` ([#32248](#32248)) ([#32249](#32249)) ([911c448](911c448)) * German translations ([b8a71ef](b8a71ef)) * group by parent child issue ([905bd96](905bd96)) * language change on setup wizard doesnt load options ([f2d59a9](f2d59a9)) * **map view:** hide sort selector ([e2f3ead](e2f3ead)) * **map view:** separate map creation and data rendering ([f3b1e2e](f3b1e2e)) * **minor:** address rendering should look same ([76624ba](76624ba)) * Portuguese translations ([d191012](d191012)) * Portuguese translations ([0fa3fec](0fa3fec)) * redundant comment in form timeline ([909a3a3](909a3a3)) * remove custom font from base font list ([039b243](039b243)) * return after setting value in set_route_filters ([bc73ae5](bc73ae5)) * selection of timezone after changing the language ([#32211](#32211)) ([#32212](#32212)) ([d355e99](d355e99)) * **setup-wizard:** create system user on initialising setup data ([#32181](#32181)) ([#32182](#32182)) ([c1cb739](c1cb739)) * **setup-wizard:** fetch translation messages only if language is changed ([#32224](#32224)) ([#32225](#32225)) ([5931711](5931711)) * sync translations from crowdin ([#32146](#32146)) ([cf3919b](cf3919b)) * Thai translations ([5e2e56d](5e2e56d)) * translatable string extraction ([#32142](#32142)) ([2aace36](2aace36)) ### Features * initialise and preload system settings and user for setup wizard ([#32108](#32108)) ([#32141](#32141)) ([c381cff](c381cff)) * **map view:** add locate control ([362bd58](362bd58)) * show link to form ([9ef262d](9ef262d)) ### Performance Improvements * 10000s of times faster global search ([#32147](#32147)) ([#32154](#32154)) ([169bfa5](169bfa5))
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Apply Read Permission to returned fields of API v2
Bug Fix for: #32045
With this change, the API v2 now checks which fields the user is allowed to see when updating documents. In comparison to the "read_doc" method, the call to "apply_fieldlevel_read_permissions" did not yet exist when saving.
The document function “save” only checks whether the permissions for write and save are available. When the document is returned, however, no check is made at any point as to which fields the user is actually permitted to read.
With "Read_doc", the permission check is carried out in the API and fields are then checked directly.