Frappe v16.20.0 Patch: Restricts Guest File Upload and Unauthorized Record Deletion

Vulnerability Overview The provided webpage screenshot primarily describes the update contents of Frappe v16.20.0, including new features, vulnerability fixes, and other changes. The vulnerability fix section mentions multiple security-related improvements and fixes. Scope of Impact Vulnerability Fixes: - Restricted guest file uploads to specific record types, preventing Doctypes from allowing Guests to upload files arbitrarily. - Ensured only System Administrators can delete records and verified access to the original document before restoration. - Standard Workspace Sidebar entries are re-exported after renaming, preventing their files from being overwritten. - Menu icons now use their own styles; spacing in the menu remains unchanged, and icons are centered in the page menu when other icons are displayed. - When a form is open, opens the application search bar instead of the browser search bar. - In Number Cards, the "Aggregate Function Based On" field is required only for the "Document Type" type; required field indicators are not displayed for other types. - Prevented Customers from inheriting old addresses when adding a new address from the Address list. - In Number Cards, "Aggregate Function Based On" is displayed only for the "Document Type" and when the function is not "Count". - Banker's rounding rules are applied to negative numbers, consistent with positive numbers. - Multi-select dialogs now retain search terms, eliminating the need to re-select items. - The system skips update prompts until the setup process is complete. - Updated "Aggregate Function Based On" in Number Cards to appear only when based on a document type and using functions other than "Count". - Fixed the FileUploader so it works even if the form does not contain an attachment section. - Updated the row selection banner: text is now readable in dark mode, and the space above the banner has been reduced. - Prevented Contact search failures when Link DocType or Link Name filters are not provided. - Fixed several minor issues, such as dashboard chart labels in dashboards, list views, and forms now displaying in the correct language, and password reset requests no longer publicly exposing password reset limits. - The database query builder is now available by default in scripts and other parts of the form. - Kanban Board views now load fields only for records, rather than every field, reducing the volume of loaded data. - Batch editing now applies filters from row editing to linked fields, providing more options. - Autocomplete fields no longer automatically select highlighted suggestions; pressing Tab keeps the current text in the next field. - PDF downloads now duplicate the last page when the Letter Head footer has fewer pages than the document, preventing errors when downloading multi-page PDFs. - Fixed the "Remove" button in multi-select fields; clicking it once removes the selected item, and the pop-up form displays the updated list. Remediation Measures Vulnerability Fixes: - Prevent unauthorized file uploads by restricting guest file uploads to specific record types. - Prevent unauthorized deletion and restoration operations by ensuring only System Administrators can delete records and by verifying access to the original document before restoration. - Prevent files from being accidentally overwritten by re-exporting standard Workspace Sidebar entries after renaming. - Prevent menu layout disorganization by ensuring menu icons use their own styles, maintain consistent spacing, and are centered in the page menu when other icons are displayed. - Prevent the accidental opening of the browser search bar by ensuring opens the application search bar when a form is open. - Prevent the display of unnecessary required fields by making "Aggregate Function Based On" required only for the "Document Type" in Number Cards. - Prevent incorrect inheritance of address information by stopping Customers from inheriting old addresses when adding new addresses from the Address list. - Prevent the display of unnecessary functions by displaying "Aggregate Function Based On" in Number Cards only for the "Document Type" and when the function is not "Count". - Prevent rounding errors by applying Banker's rounding rules to negative numbers consistently with positive numbers. - Prevent the need for re-selection by ensuring multi-select dialogs retain search terms. - Prevent update prompts from interfering with user operations by skipping them until the setup process is complete. - Prevent the display of unnecessary functions by updating "Aggregate Function Based On" in Number Cards to appear only when based on a document type and using functions other than "Count". - Prevent attachment upload failures by fixing the FileUploader to work even if the form lacks an attachment section. - Prevent banners from obscuring content by updating the row selection banner for readability in dark mode and reducing the space above the banner. - Prevent search failures

Goal Reached Thanks to every supporter — we hit 100%!

Frappe v16.20.0 Patch: Restricts Guest File Upload and Unauthorized Record Deletion

More from this source