Functionality issue in the Calendar view of Attendance doctype

[ArunaDevraj]

Information about bug

When logged in as an employee myself, I am able to view the attendance records of all other employees in the "Calendar View" format. This is a potential data privacy concern. A screenshot of the issue has been attached for reference.

Module

HR

Version

ERPNext - v15.42.0 (version-15)
Frappe Framework: v15.47.2 (version-15)
Frappe HR: v15.23.0 (version-15)

Installation method

manual install

Relevant log output / Stack trace / Full Error Message.

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[ArunaDevraj]

I solved the issue by editing the core attendance.py file. (Path: home/frappe-user/frappe-bench/apps/hrms/hrms/hr/doctype/attendance/attendance.py)
I also attached the screenshot of the code and the obtained output.

[ruchamahabal]

will have to change this API to return permission-sensitive calendar events with get_list

hrms/hrms/hr/doctype/attendance/attendance.py

Line 230 in b239764

def get_events(start, end, filters=None):

Currently does a raw sql query