Attachments create Public File Copy

[tomf]

When adding a File that is already in the System as an attachment, frappe creates a public copy of that file. See Attach creates public File Copy · Issue #20938 · frappe/frappe · GitHub

Related Topics:

Files Handling Security Issue

Now in V12.7 I can not access to private fiels even if I have System Manager role! How can I fix this problem

Default File Setting to Private

You can force all file is private by using hook ‘after_insert’ hooks.py doc_events = { “File” : { “after_insert”: “en_crm.overrides.issue.private_file_alter_insert”, } } function handle hook in file issue.py def private_file_alter_insert(doc_str, method): frappe.logger().info(f’ got doc before insert {doc_str.as_dict()}‘) doc_dict = doc_str.as_dict() doc_file = frappe.get_doc(doc_dict.get(“doctype”), doc_dict.get(“name”)) try: doc_file.is_private = 1 doc_file.save() except Excepti…

[doca]

After seeing the github issue, I think that this is quite a big security issue!!

Can anybody from Frappe comment on this?

[eleben]

I agree with this assessment - this is a major issue with documents that shouldn’t be made public. For example there are signed invoices or other business sensitive documents being attached which are being made public.

What I’m finding is when a document has an attachment set to private, the attachment remains private. However if I cancel the document and amend it, the attachment now becomes public without making any other changes to the document.