User permissions are too wide

ERPNext
, ,
1

It appears that a brand-new user, with an extremely limited set of given permissions, is able to see way more than allowed. Any ideas?

Reproduction steps:

:one: I have created a new role, with a very limited set of permissions, for just one doctype (Lead):

image
image2546×880 137 KB

:two: Then I created a new user and assigned only that one role.

image
image2110×1272 228 KB

:three: And I limited the allowed modules to only CRM:

image
image2120×1040 156 KB

Now, when I login as that user, I am able to see way more stuff, including the full user list in the system!

image
image2552×1320 184 KB

My setup is vanilla, the default install, from the docker frappe repo.

ERPNext: v14.25.1
Frappe Framework: v14.36.3

This is my installation:

git clone git@github.com:frappe/frappe_docker.git
cd frappe_docker
docker compose -f pwd.yml up --pull=always

I didn’t do any other modifications or extra configurations.

2

You can restrict user to the relevant documents or doctypes by applying user permissions from doctype User Permission.

Follow this Link for more info.

1 Like