Attachments create Public File Copy

[tomf]

When adding a File that is already in the System as an attachment, frappe creates a public copy of that file. See Attach creates public File Copy · Issue #20938 · frappe/frappe · GitHub

Related Topics:

Files Handling Security Issue

Now in V12.7 I can not access to private fiels even if I have System Manager role! How can I fix this problem

Default File Setting to Private

You can force all file is private by using hook ‘after_insert’ hooks.py doc_events = { “File” : { “after_insert”: “en_crm.overrides.issue.private_file_alter_insert”, } } function handle hook in file issue.py def private_file_alter_insert(doc_str, method): frappe.logger().info(f’ got doc before insert {doc_str.as_dict()}‘) doc_dict = doc_str.as_dict() doc_file = frappe.get_doc(doc_dict.get(“doctype”), doc_dict.get(“name”)) try: doc_file.is_private = 1 doc_file.save() except Excepti…

[doca]

After seeing the github issue, I think that this is quite a big security issue!!

Can anybody from Frappe comment on this?