search

agritheory / cloud_storage

S3 protocol storage for Frappe Applications - compatible with S3, Backblaze and DO Spaces
https://agritheory.com/documentation/cloud_storage
Other
12 stars 7 forks source link

More Assumptions for `has_permission` #16

Closed agritheory closed 2 months ago

agritheory commented 1 year ago

https://github.com/agritheory/cloud_storage/blob/version-14/cloud_storage/cloud_storage/overrides/file.py#L32

Shared With case: We want to add another if block here to check if the file itself has been shared with anyone and to validate that with frappe.session.user.

Folder Shared With case: Check if the parent folder has been explicitly shared with frappe.session.user. If there are no shared_with users, recursively check the parent folder until a shared_with value is found, and if frappe.session.user is present, otherwise deny.

agritheory commented 2 months ago

This has been fixed upstream in Frappe