Projects page on the website portal is public, anyone can see it

[juanc1479]

Information about bug

Under an incognito and unlogged user, I can access the list of projects when they should be private and only accessible when signed in with the correct permissions. erp.example.com/project When I click on erp.example.com/newsletters they are inaccessible and I need to log in, which is correct as I set the newsletters to private.

Could you point me to where in the code base I can look to see if I can fix the privacy issue? Thank you.

Module

projects, portal

Version

ERPNext: v15.8.3 (version-15)
Frappe Framework: v15.7.0 (version-15)
Frappe HR: v15.7.1 (version-15)
Payments: v0.0.1 (version-15)

Installation method

manual install

Relevant log output / Stack trace / Full Error Message.

I checked the logs in the sites folder, but I couldn't find the line items related to this bug. Are there other logs where I can find more information about this bug?

[agritheory]

@juanc1479 What you say is true - that it is configured to be visible by default. You can disable it in Portal Settings.

[juanc1479]

After disabling the menu item and changing the Route, public access to the list of projects remains for non-logged-in users.

[agritheory]

@juanc1479 I agree, that doesn't seem right. The file you asked for is located here, but I don't see a problem. I guess there's an edge case where the "Guest" user could be a "Project User". Are these projects all the ones in your database?

https://github.com/frappe/erpnext/blob/version-15/erpnext/templates/pages/projects.py

[juanc1479]

Yes, those are all the projects in the database.

[juanc1479]

These are the current role permissions for Guest:

[agritheory]

In the "Users" section of those projects, can you see if there is a "Guest" user? That eliminates the edge case.

[juanc1479]

The "Users" section is empty:

Could the bug originate from line 16 where the IF statement grants the "Guest" user access to the project list?

if frappe.session.user != "Administrator" and (
not project_user or frappe.session.user == "Guest"

[agritheory]

This hasn't changed since V14 and it works correctly on my V14 instance. I suspect this is not the source of the bug. This is most likely a configuration problem, but I don't know where it could be coming from. Testing locally in V14 works as expected.

[juanc1479]

I installed both ERPNext V14 and V15 versions without any modifications. On V14 erp.example.com/project the project list is inaccessible. On V15, the erp.example.com/project project list is public to any user who is not logged in. I presume there was a code change in V15 that is allowing the project list to be public.

[SvbZ3r0]

Can confirm this issue exists on my v15 instance.

[s-aga-r]

@juanc1479 Duplicate of #39155

[0xD0M1M0]

@s-aga-r I found the issue. It is not in the frappe/frappe, but an frappe/erpnext issue. Permissions in

frappe-bench/apps/erpnext/erpnext/projects/doctype/project/project.py : get_project_list

are overwritten with "ignore_permissions = True". The problem with fixing it is the following:

The permissions check, for the users are "complicated". There are the "Portal User" permissions by the Supplier and Customer and the "Project User Permissions". Which one should be taken into account? I would personnaly opt for the "Project User Permission" to be checked and validated if set. I think this is not at all in the code. At least the line:

if is_website_user():

should be at least:

if is_website_user() and user!="Guest":

and ignore_permissions = True should be inside the if:

if customers:
    filters.append([doctype, "customer", "in", customers])
    ignore_permissions = True

This fixes the main issue.