How can we restrict attachments if its set to private

Mubasher · March 22, 2025, 10:37am

Hi there hope everyone is doing great

as you can see i have uploaded 2 files one as public and one as private but when a user open the documents he can see both the public and private files is there any option to restrict user to see only public and not private files thankyou for your time and assistance

avc · March 22, 2025, 10:55am

Hi @Mubasher:

“Private” means that files are not accesible without login.

Basically, anyone logged in who gets access to the doctype will get access to the attached documents too. Maybe it could be managed with permission over File Doctype but you will need add some logic to that.

Hope this helps.

Mubasher · March 22, 2025, 10:56am

in file doctype its working fine i set it to only if creater but lets say i attach afile in opportunity document and set it to private so anybody who has access to opportunity can view it this is the issue @avc

Mubasher · March 22, 2025, 10:58am

my requirments are
in opportunity if its set to private it can only be accessible to the the person who uploaded
so in file doctype its working fine only the owner can see the documents but in other documents its accessible to all even if set to private

avc · March 22, 2025, 11:43am

Hi @Mubasher :

Actually, this is not the “Private” option purpose.

Form uses frappe.model.docinfo that returns all the files, without considering permission over the file document.

This get_attachments method on load.py is the key, get_all don’t check perms.

github.com

frappe/frappe/blob/e9aa5e21b94f39004cb82703b7ba1b14690a0ca7/frappe/desk/form/load.py#L185


      
          
          
          def get_milestones(doctype, name):
          	return frappe.get_all(
          		"Milestone",
          		fields=["creation", "owner", "track_field", "value"],
          		filters=dict(reference_type=doctype, reference_name=name),
          	)
          
          
          def get_attachments(dt, dn):
          	return frappe.get_all(
          		"File",
          		fields=["name", "file_name", "file_url", "is_private"],
          		filters={"attached_to_name": dn, "attached_to_doctype": dt},
          	)
          
          
          def get_versions(doc: "Document") -> list[dict]:
          	if not doc.meta.track_changes:
          		return []

Bug? I don’t know, you will find thousands of different use cases. Maybe it could be added as DocType option “Consider permission for attachments”.

For now, I think you’ll need to customize.

Possible (and dirty) approach:

Use client script to hide attachments sidebar with $(".form-attachments").hide()
Add a child table to show the “permitted” files.
Add a button to attach file “manually”

Hope this helps.

Edit: related private_files accessible to all user despite permission control · Issue #28086 · frappe/frappe · GitHub

Mubasher · March 22, 2025, 11:53am

yes i can say its a bug so i am trying to control through side server i m trying to get a solution if not then child table for attachmetns is the best approach for now