Merge pull request #22682 from frappe/version-14-hotfix

chore: release v14

frappe/contacts/doctype/address/address.json

@@ -148,7 +148,7 @@
  "icon": "fa fa-map-marker",
  "idx": 5,
  "links": [],
- "modified": "2020-10-21 16:14:37.284830",
+ "modified": "2023-10-11 11:48:26.954934",
  "modified_by": "Administrator",
  "module": "Contacts",
  "name": "Address",
@@ -208,9 +208,18 @@
    "set_user_permissions": 1,
    "share": 1,
    "write": 1
+  },
+  {
+   "create": 1,
+   "if_owner": 1,
+   "print": 1,
+   "read": 1,
+   "role": "All",
+   "write": 1
   }
  ],
  "search_fields": "country, state",
  "sort_field": "modified",
- "sort_order": "DESC"
+ "sort_order": "DESC",
+ "states": []
 }

frappe/contacts/doctype/address/address.py

@@ -131,7 +131,9 @@ def get_address_display(address_dict: dict | str | None = None) -> str | None:
 		return
 
 	if not isinstance(address_dict, dict):
-		address_dict = frappe.db.get_value("Address", address_dict, "*", as_dict=True, cache=True) or {}
+		address = frappe.get_cached_doc("Address", address_dict)
+		address.check_permission()
+		address_dict = address.as_dict()
 
 	name, template = get_address_templates(address_dict)
 

frappe/contacts/doctype/contact/contact.json

@@ -250,7 +250,7 @@
  "image_field": "image",
  "index_web_pages_for_search": 1,
  "links": [],
- "modified": "2020-08-27 14:12:09.906719",
+ "modified": "2023-10-06 11:52:34.088559",
  "modified_by": "Administrator",
  "module": "Contacts",
  "name": "Contact",
@@ -378,8 +378,17 @@
    "read": 1,
    "report": 1,
    "role": "All"
+  },
+  {
+   "create": 1,
+   "email": 1,
+   "print": 1,
+   "read": 1,
+   "role": "All",
+   "write": 1
   }
  ],
  "sort_field": "modified",
- "sort_order": "ASC"
+ "sort_order": "ASC",
+ "states": []
 }

frappe/contacts/doctype/contact/contact.py

@@ -179,7 +179,9 @@ def invite_user(contact):
 @frappe.whitelist()
 def get_contact_details(contact):
 	contact = frappe.get_doc("Contact", contact)
-	out = {
+	contact.check_permission()
+
+	return {
 		"contact_person": contact.get("name"),
 		"contact_display": " ".join(
 			filter(None, [contact.get("salutation"), contact.get("first_name"), contact.get("last_name")])
@@ -190,7 +192,6 @@ def get_contact_details(contact):
 		"contact_designation": contact.get("designation"),
 		"contact_department": contact.get("department"),
 	}
-	return out
 
 
 def update_contact(doc, method):

frappe/core/doctype/file/file.py

@@ -732,7 +732,11 @@ def has_permission(doc, ptype=None, user=None):
 		attached_to_doctype = doc.attached_to_doctype
 		attached_to_name = doc.attached_to_name
 
-		ref_doc = frappe.get_doc(attached_to_doctype, attached_to_name)
+		try:
+			ref_doc = frappe.get_doc(attached_to_doctype, attached_to_name)
+		except frappe.DoesNotExistError:
+			frappe.clear_last_message()
+			return False
 
 		if ptype in ["write", "create", "delete"]:
 			return ref_doc.has_permission("write")

frappe/desk/query_report.py

@@ -581,7 +581,9 @@ def get_filtered_data(ref_doctype, columns, data, user):
 	if match_filters_per_doctype:
 		for row in data:
 			# Why linked_doctypes.get(ref_doctype)? because if column is empty, linked_doctypes[ref_doctype] is removed
-			if linked_doctypes.get(ref_doctype) and shared and row[linked_doctypes[ref_doctype]] in shared:
+			if (
+				linked_doctypes.get(ref_doctype) and shared and row.get(linked_doctypes[ref_doctype]) in shared
+			):
 				result.append(row)
 
 			elif has_match(

frappe/integrations/doctype/integration_request/integration_request.json

@@ -101,7 +101,7 @@
   },
   {
    "fieldname": "url",
-   "fieldtype": "Data",
+   "fieldtype": "Small Text",
    "label": "URL",
    "read_only": 1
   },
@@ -129,7 +129,7 @@
  ],
  "in_create": 1,
  "links": [],
- "modified": "2022-04-07 11:32:27.557548",
+ "modified": "2023-10-09 09:36:23.856188",
  "modified_by": "Administrator",
  "module": "Integrations",
  "name": "Integration Request",

frappe/permissions.py

@@ -180,7 +180,7 @@ def is_user_owner():
 		return (doc.get("owner") or "").lower() == user.lower()
 
 	if has_controller_permissions(doc, ptype, user=user) is False:
-		push_perm_check_log("Not allowed via controller permission check")
+		push_perm_check_log(_("Not allowed via controller permission check"))
 		return {ptype: 0}
 
 	permissions = copy.deepcopy(get_role_permissions(meta, user=user, is_owner=is_user_owner()))
@@ -703,7 +703,7 @@ def push_perm_check_log(log):
 	if frappe.flags.get("has_permission_check_logs") is None:
 		return
 
-	frappe.flags.get("has_permission_check_logs").append(_(log))
+	frappe.flags.get("has_permission_check_logs").append(log)
 
 
 def has_child_permission(

frappe/public/js/frappe/form/controls/multicheck.js

@@ -14,10 +14,13 @@ frappe.ui.form.ControlMultiCheck = class ControlMultiCheck extends frappe.ui.for
 		this.$select_buttons = this.get_select_buttons().appendTo(this.wrapper);
 		this.$load_state.appendTo(this.wrapper);
 
-		const row = this.get_column_size() === 12 ? "" : "row";
-		this.$checkbox_area = $(`<div class="checkbox-options ${row}"></div>`).appendTo(
-			this.wrapper
-		);
+		// In your implementation, you may use the 'columns' property to specify either of:
+		// - minimum column width, e.g. `"15rem"`
+		// - fixed number of columns, e.g. `3`
+		// - both minimum column width and maximum number of columns, e.g. `"15rem 5"`
+		const columns = this.df.columns;
+		this.$checkbox_area = $('<div class="checkbox-options"></div>').appendTo(this.wrapper);
+		this.$checkbox_area.get(0).style.setProperty("--checkbox-options-columns", columns);
 	}
 
 	refresh() {
@@ -145,9 +148,8 @@ frappe.ui.form.ControlMultiCheck = class ControlMultiCheck extends frappe.ui.for
 	}
 
 	get_checkbox_element(option) {
-		const column_size = this.get_column_size();
 		return $(`
-			<div class="checkbox unit-checkbox col-sm-${column_size}">
+			<div class="checkbox unit-checkbox">
 				<label title="${option.description || ""}">
 					<input type="checkbox" data-unit="${option.value}"></input>
 					<span class="label-area" data-unit="${option.value}">${__(option.label)}</span>
@@ -168,8 +170,4 @@ frappe.ui.form.ControlMultiCheck = class ControlMultiCheck extends frappe.ui.for
 		</div>
 		`);
 	}
-
-	get_column_size() {
-		return 12 / (+this.df.columns || 1);
-	}
 };

frappe/public/js/frappe/form/grid_row.js

@@ -338,7 +338,7 @@ export default class GridRow {
 					this.open_form_button = $(`
 						<div class="btn-open-row">
 							<a>${frappe.utils.icon("edit", "xs")}</a>
-							<div class="hidden-md edit-grid-row">${__("Edit")}</div>
+							<div class="hidden-md edit-grid-row">${__("Edit", "", "Edit grid row")}</div>
 						</div>
 					`)
 						.appendTo(this.open_form_button)

frappe/public/js/frappe/form/sidebar/attachments.js

@@ -139,7 +139,9 @@ frappe.ui.form.Attachments = class Attachments {
 		var me = this;
 
 		let file_label = `
-			<a href="${file_url}" target="_blank" title="${file_name}" class="ellipsis" style="max-width: calc(100% - 43px);">
+			<a href="${file_url}" target="_blank" title="${frappe.utils.escape_html(file_name)}"
+				class="ellipsis" style="max-width: calc(100% - 43px);"
+			>
 				<span>${file_name}</span>
 			</a>`;
 

frappe/public/js/frappe/list/bulk_operations.js

@@ -235,7 +235,11 @@ export default class BulkOperations {
 	}
 
 	edit(docnames, field_mappings, done) {
-		let field_options = Object.keys(field_mappings).sort();
+		let field_options = Object.keys(field_mappings).sort(function (a, b) {
+			return __(cstr(field_mappings[a].label)).localeCompare(
+				cstr(__(field_mappings[b].label))
+			);
+		});
 		const status_regex = /status/i;
 
 		const default_field = field_options.find((value) => status_regex.test(value));

frappe/public/js/frappe/list/list_view.js

@@ -1014,8 +1014,11 @@ frappe.views.ListView = class ListView extends frappe.views.BaseList {
 		link.dataset.doctype = this.doctype;
 		link.dataset.name = doc.name;
 		link.href = this.get_form_link(doc);
-		link.title = value.toString();
-		link.textContent = value.toString();
+		// "Text Editor" and some other fieldtypes can have html tags in them so strip and show text.
+		// If no text is found show "No Text Found in {Field Label}"
+		let textValue = frappe.utils.html2text(value);
+		link.title = textValue;
+		link.textContent = textValue;
 
 		return div.innerHTML;
 	}

frappe/public/js/frappe/module_editor.js

@@ -9,7 +9,7 @@ frappe.ModuleEditor = class ModuleEditor {
 				fieldname: "block_modules",
 				fieldtype: "MultiCheck",
 				select_all: true,
-				columns: 3,
+				columns: "15rem",
 				get_data: () => {
 					return this.frm.doc.__onload.all_modules.map((module) => {
 						return {

frappe/public/js/frappe/roles_editor.js

@@ -10,7 +10,7 @@ frappe.RoleEditor = class {
 				fieldname: "roles",
 				fieldtype: "MultiCheck",
 				select_all: true,
-				columns: 3,
+				columns: "15rem",
 				get_data: () => {
 					return frappe
 						.xcall("frappe.core.doctype.user.user.get_all_roles")

frappe/public/js/frappe/ui/filters/filter_list.js

@@ -36,7 +36,7 @@ frappe.ui.FilterGroup = class {
 	}
 
 	hide_popover() {
-		this.filter_button.popover("hide");
+		this.filter_button?.popover("hide");
 	}
 
 	init_filter_popover() {

frappe/public/js/frappe/web_form/web_form_list.js

@@ -109,6 +109,12 @@ export default class WebFormList {
 	}
 
 	fetch_data() {
+		if (this.condition_json && JSON.parse(this.condition_json)) {
+			let filter = frappe.utils.get_filter_from_json(this.condition_json);
+			filter = frappe.utils.get_filter_as_json(filter);
+			this.filters = Object.assign(this.filters, JSON.parse(filter));
+		}
+
 		let args = {
 			method: "frappe.www.list.get_list_data",
 			args: {

frappe/public/js/frappe/web_form/webform_script.js

@@ -27,6 +27,7 @@ frappe.ready(function () {
 			doctype: web_form_doc.doc_type,
 			web_form_name: web_form_doc.name,
 			list_columns: web_form_doc.list_columns,
+			condition_json: web_form_doc.condition_json,
 			settings: {
 				allow_delete: web_form_doc.allow_delete,
 			},

frappe/public/scss/desk/css_variables.scss

@@ -3,12 +3,12 @@
 :root,
 [data-theme="light"] {
 	// breakpoints
-	--xxl-width: map-get($grid-breakpoints, '2xl');
-	--xl-width: map-get($grid-breakpoints, 'xl');
-	--lg-width: map-get($grid-breakpoints, 'lg');
-	--md-width: map-get($grid-breakpoints, 'md');
-	--sm-width: map-get($grid-breakpoints, 'sm');
-	--xs-width: map-get($grid-breakpoints, 'xs');
+	--xxl-width: #{map-get($grid-breakpoints, '2xl')};
+	--xl-width: #{map-get($grid-breakpoints, 'xl')};
+	--lg-width: #{map-get($grid-breakpoints, 'lg')};
+	--md-width: #{map-get($grid-breakpoints, 'md')};
+	--sm-width: #{map-get($grid-breakpoints, 'sm')};
+	--xs-width: #{map-get($grid-breakpoints, 'xs')};
 
 	--text-bold: 500;
 

frappe/templates/styles/standard.css

@@ -78,6 +78,10 @@
 	margin: 20px 0px;
 }
 
+.checkbox-options {
+	columns: var(--checkbox-options-columns);
+}
+
 .square-image {
 	width: 100%;
 	height: 0;

frappe/translations/fr.csv

@@ -4751,3 +4751,4 @@ No Results found,Aucun résultat trouvé
 Shelf Life in Days,Durée de conservation (en jours)
 Batch Expiry Date,Date d'expiration du Lot,
 Edit Full Form,Ouvrir le formulaire complet
+Edit,Détail,Edit grid row

frappe/website/doctype/help_article/help_article.py

@@ -3,6 +3,7 @@
 
 import frappe
 from frappe import _
+from frappe.rate_limiter import rate_limit
 from frappe.utils import cint, is_markdown, markdown
 from frappe.website.utils import get_comment_list
 from frappe.website.website_generator import WebsiteGenerator
@@ -110,10 +111,11 @@ def clear_website_cache(path=None):
 
 
 @frappe.whitelist(allow_guest=True)
-def add_feedback(article, helpful):
-	field = "helpful"
-	if helpful == "No":
-		field = "not_helpful"
+@rate_limit(key="article", limit=5, seconds=60 * 60)
+def add_feedback(article: str, helpful: str):
+	if not isinstance("article", str):
+		frappe.throw(_("Invalid Article Name"))
 
+	field = "not_helpful" if helpful == "No" else "helpful"
 	value = cint(frappe.db.get_value("Help Article", article, field))
 	frappe.db.set_value("Help Article", article, field, value + 1, update_modified=False)