Merge pull request #22769 from frappe/version-13-hotfix

chore: release v13

frappe/contacts/doctype/address/address.json

@@ -148,7 +148,7 @@
  "icon": "fa fa-map-marker",
  "idx": 5,
  "links": [],
- "modified": "2020-10-21 16:14:37.284830",
+ "modified": "2023-10-11 11:48:26.954934",
  "modified_by": "Administrator",
  "module": "Contacts",
  "name": "Address",
@@ -208,6 +208,14 @@
    "set_user_permissions": 1,
    "share": 1,
    "write": 1
+  },
+  {
+   "create": 1,
+   "if_owner": 1,
+   "print": 1,
+   "read": 1,
+   "role": "All",
+   "write": 1
   }
  ],
  "search_fields": "country, state",

frappe/contacts/doctype/address/address.py

@@ -138,7 +138,9 @@ def get_address_display(address_dict):
 		return
 
 	if not isinstance(address_dict, dict):
-		address_dict = frappe.db.get_value("Address", address_dict, "*", as_dict=True, cache=True) or {}
+		address = frappe.get_cached_doc("Address", address_dict)
+		address.check_permission()
+		address_dict = address.as_dict()
 
 	name, template = get_address_templates(address_dict)
 

frappe/contacts/doctype/contact/contact.py

@@ -183,7 +183,9 @@ def invite_user(contact):
 @frappe.whitelist()
 def get_contact_details(contact):
 	contact = frappe.get_doc("Contact", contact)
-	out = {
+	contact.check_permission()
+
+	return {
 		"contact_person": contact.get("name"),
 		"contact_display": " ".join(
 			filter(None, [contact.get("salutation"), contact.get("first_name"), contact.get("last_name")])
@@ -194,7 +196,6 @@ def get_contact_details(contact):
 		"contact_designation": contact.get("designation"),
 		"contact_department": contact.get("department"),
 	}
-	return out
 
 
 def update_contact(doc, method):

frappe/desk/doctype/tag/tag.py

@@ -39,8 +39,6 @@ def add_tags(tags, dt, docs, color=None):
 		for tag in tags:
 			DocTags(dt).add(doc, tag)
 
-	# return tag
-
 
 @frappe.whitelist()
 def remove_tag(tag, dt, dn):
@@ -153,8 +151,8 @@ def update_tags(doc, tags):
 
 	:param doc: Document to be added to global tags
 	"""
-
-	new_tags = list(set([tag.strip() for tag in tags.split(",") if tag]))
+	doc.check_permission("write")
+	new_tags = {tag.strip() for tag in tags.split(",") if tag}
 	existing_tags = [
 		tag.tag
 		for tag in frappe.get_list(

frappe/permissions.py

@@ -157,7 +157,7 @@ def is_user_owner():
 		return (doc.get("owner") or "").lower() == frappe.session.user.lower()
 
 	if has_controller_permissions(doc, ptype, user=user) is False:
-		push_perm_check_log("Not allowed via controller permission check")
+		push_perm_check_log(_("Not allowed via controller permission check"))
 		return {ptype: 0}
 
 	permissions = copy.deepcopy(get_role_permissions(meta, user=user, is_owner=is_user_owner()))
@@ -674,4 +674,5 @@ def filter_allowed_docs_for_doctype(user_permissions, doctype, with_default_doc=
 def push_perm_check_log(log):
 	if frappe.flags.get("has_permission_check_logs") == None:
 		return
-	frappe.flags.get("has_permission_check_logs").append(_(log))
+
+	frappe.flags.get("has_permission_check_logs").append(log)

frappe/public/js/frappe/list/list_view.js

@@ -970,8 +970,11 @@ frappe.views.ListView = class ListView extends frappe.views.BaseList {
 		link.dataset.doctype = this.doctype;
 		link.dataset.name = doc.name;
 		link.href = this.get_form_link(doc);
-		link.title = value.toString();
-		link.textContent = value.toString();
+		// "Text Editor" and some other fieldtypes can have html tags in them so strip and show text.
+		// If no text is found show "No Text Found in {Field Label}"
+		let textValue = frappe.utils.html2text(value);
+		link.title = textValue;
+		link.textContent = textValue;
 
 		return div.innerHTML;
 	}