fix: Check if note has permission (frappe#22750)

metalmon · Oct 16, 2023 · db3e4c9 · db3e4c9
1 parent 3effd9e
commit db3e4c9
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/frappe/desk/doctype/note/note.py b/frappe/desk/doctype/note/note.py
@@ -54,3 +54,7 @@ def get_permission_query_conditions(user):
 		user = frappe.session.user
 
 	return f"(`tabNote`.owner = {frappe.db.escape(user)} or `tabNote`.public = 1)"
+
+
+def has_permission(doc, user):
+	return doc.public or doc.owner == user
diff --git a/frappe/hooks.py b/frappe/hooks.py
@@ -122,6 +122,7 @@
 has_permission = {
 	"Event": "frappe.desk.doctype.event.event.has_permission",
 	"ToDo": "frappe.desk.doctype.todo.todo.has_permission",
+	"Note": "frappe.desk.doctype.note.note.has_permission",
 	"User": "frappe.core.doctype.user.user.has_permission",
 	"Dashboard Chart": "frappe.desk.doctype.dashboard_chart.dashboard_chart.has_permission",
 	"Number Card": "frappe.desk.doctype.number_card.number_card.has_permission",