I was wondering if there were any downsides for whitelisting functions for server scripts? I have a GitHub issue regarding whitelisting a function called get_mapped_doc, which you can find here: Whitelisting get_mapped_doc · Issue #13957 · frappe/frappe · GitHub. Does this have any potential security issues?
1 Like
upvoted the issue.
I think you can avoid security issues by avoiding functions like frappe.db.get_all() that don’t apply permissions implicitly. Same goes for frappe.db.sql().
You can also get creative by getting the current user with frappe.session.user and implement whatever checks you deem helpful.
Not sure how to understand your suggestion. Can you maybe elaborate? I agree with @MajikalExplosions: If you want to automate the creation of downstream doctypes using a server script (e.g. create an invoice automatically when submitting an order), one would need to access the internal Frappe function “get_mapped_doc()”. This is the function Frappe uses e.g. if you click on create invoice in the order doctype. Currently, this does not seem to be possible to call from a server script. Whitelisting the function would allow this functionality.
Sorry, I misunderstood. I thought this was about securing whitelisted functions.
1 Like