Private files not accessible to Customer on Web Portal

Use case : To allow access to private files to Customers role ,but not to anyone having the file URL.

At present if a file is private it is accessible to all the roles having Desk access on the web portal.

How to allow access on web portal for the private files to Customer role , not having desk access.

Is this a bug or functionality or is there any workaround ?

Bumping this thread… We have a need for the same use case. Hope someone can suggest a solution.

Update on this: the following is the solution we came up with for this particular use case.

We just created this whitelisted python function:

import frappe, os, urlparse

def view_attachment(file_name, user):
	if not user == frappe.session.user:
		frappe.msgprint("Session error.", indicator="red")
	user = frappe.get_doc("User", user)
	if not user:
		frappe.throw("Authorization error.")
	cwd = os.getcwd()
	attachment = frappe.get_doc("File", file_name)
	if attachment:
		file_name = attachment.get('file_name')
		file_url  = attachment.get('file_url')
		if not file_name and is_in_erp( file_url ): # to handle web url attachments
			parsed_url = urlparse( file_url )
			file_url   = parsed_url.path
			file_name  = "Attachment"
		if is_public_file( file_url ):
			file_path = cwd + "/our.erpinstance.tld/public" + file_url
			file_path = cwd + "/our.erpinstance.tld" + file_url
		frappe.throw("File not found.")
	with open(file_path, "rb") as fileobj:
		filedata =
	frappe.local.response.filename = file_name
	frappe.local.response.filecontent = filedata
	frappe.local.response.type = "download"

def is_public_file(file_path):
	if file_path[0:7] == "/files/":
		return True
		return False

def is_in_erp(a_url):
	parsed_url = urlparse(a_url)
	if parsed_url.netloc == 'our.erpinstance.tld':
		return True
		return False

And for the website users to view private files, you then just have to link to the file this way:


var request_url = "/api/method/"
                + "?file_name="+encodeURIComponent("File Name Here")
                + "&user="+encodeURIComponent(frappe.session.user);


<a href="{{ request_url }}" target="_blank">File Name Here</a>

Hope this helps.


Another solution is to temporarily update session. link

1 Like

Simply share the file to the customer using the share option from the File doctype

This sets a document level read permission to the user.
If the customer is logged on the portal then they can access the file over link you have shared