fix: do not allow editing other's private workspaces

(cherry picked from commit 7343c83)
frappe · Oct 17, 2023 · 11dd3a7 · 11dd3a7
1 parent caa28b8
commit 11dd3a7
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/frappe/desk/doctype/workspace/workspace.py b/frappe/desk/doctype/workspace/workspace.py
@@ -238,6 +238,16 @@ def update_page(name, title, icon, parent, public):
 	public = frappe.parse_json(public)
 	doc = frappe.get_doc("Workspace", name)
 
+	if (
+		not doc.get("public")
+		and doc.get("for_user") != frappe.session.user
+		and not is_workspace_manager()
+	):
+		frappe.throw(
+			_("Need Workspace Manager role to edit private workspace of other users"),
+			frappe.PermissionError,
+		)
+
 	if doc:
 		doc.title = title
 		doc.icon = icon