Force uploads to be private by default

[bcornwellmott]

Uploads should be private by default so that sensitive information doesn't accidentally get shared with the public.

Demo:

[rmehta]

I think we should let image files be public by default, others private. What do you think? Otherwise users will not be able to send images in their quotes etc.

[bcornwellmott]

I've added a check to see if the options type is image, in which case it will make it public. I think that addresses the issue.

[bcornwellmott]

[rmehta]

Let me check this in a bit. I am not sure we tag images in options... Maybe we can use popular extensions like gif, jpg, png, jpeg (I can push a fix too)

[bcornwellmott]

Thanks! I think having Item images default to public is a good idea, but that doing all images might be a problem. You might have a scanned receipt, invoice etc that you attach to a document and you don't want that defaulting to public.

EDIT: Maybe we should default to private for standard document attachments (done through the frappe Attach+ button on the left), but for fields (attach or attach image) we can create an option for making the field default to attach public.

[rmehta]

I agree, lets make all "Image" type fields as public by default and others private. I think you have to update the attach_image.js file for that.

[bcornwellmott]

So I made a simple change which I think addresses the issue. If the docfield option (in "Attach" and "Attach Image" field types) says either "image" or "public", the attachment will default to public. If there is nothing (or something else in options), the attachment will default to private.

Does this address it well enough? This way it can be configured for each field.