Fixed patch

Hotfix

* Update site.py

Fixed --db-name ignoring when creating new-site

* Update site.py

Fixed --db-name ignoring when creating new-site

[fix] fetch values server side for link fields

* Add disabling of buttons

* Commonify polar functions

*  added  Bulk Upload from zip file feature #2055

* Added upload zip in file list

* Fix File URL

* Update file_list.js

* Carry over file attachments in email communications

* [fix] style

[feature] merge knowledge base in Frappe, fixes frappe/erpnext#6030

* Carry over file attachments in amended doctypes

* Renamed function and code style

* [Fix] Updated condition to allow only 3 reports per user

* [fix] different conditions for insert and update

* Font-Awesome V3.x to V4.x

Font-Awesome V3.x to V4.x

* Font Tidy

Font Tidy

* FA4 Upgrade - Html Js & Json

FA4 Upgrade - Html Js & Json

* Minor

Minor

* refactor assign_to dialog for ease of use

* CamelCase for classes

* Update doclistview.js

improved error messages for canceled links

Optimize rename doc query

[Minor] convert date type to string when field is set as 'set_only_once' or constant

Delete child table rows without causing database deadlock

[URGENT] Prevent accessing sensitive files in client.get_js

Logged in user (any permissions) can access sensitive files by calling frappe.client.get_js

Consider the following scenario:
1- Login to system
2- http://HOST/?items=["currentsite.txt"]&cmd=frappe.client.get_js  (this will give you site directory name)
3- http://HOST/?items=["SITE_DIR_NAME%2Fsite_config.json"]&cmd=frappe.client.get_js (this will show you site config including database name and password and any other sensitive data

The suggested fix prevent accessing any file outside the assets folder. (or atleast you should prevent access to .py files and private folder which includes backup and sensetive files and logs folders)

There should be a hot fix asap

[URGENT] Prevent accessing sensitive files in client.get_js

Logged in user (any permissions) can access sensitive files by calling frappe.client.get_js

Consider the following scenario:
1- Login to system
2- http://HOST/?items=["currentsite.txt"]&cmd=frappe.client.get_js  (this will give you site directory name)
3- http://HOST/?items=["SITE_DIR_NAME%2Fsite_config.json"]&cmd=frappe.client.get_js (this will show you site config including database name and password and any other sensitive data

The suggested fix prevent accessing any file outside the assets folder. (or atleast you should prevent access to .py files and private folder which includes backup and sensetive files and logs folders)

There should be a hot fix asap