From c97a5e813c78661d2ab8899595d3ae3826a4df38 Mon Sep 17 00:00:00 2001
From: Jannat Patel <pateljannat2308@gmail.com>
Date: Mon, 19 Jan 2026 11:47:57 +0530
Subject: [PATCH] fix: only system users can access high level APIs

---
 frontend/src/components/CourseCardOverlay.vue |  2 +-
 frontend/src/components/LiveClass.vue         |  6 +-
 .../src/components/UpcomingEvaluations.vue    |  2 +-
 frontend/src/pages/Courses.vue                |  2 +-
 frontend/src/pages/JobForm.vue                |  2 +-
 lms/auth.py                                   | 59 +++++++++++++++++++
 lms/hooks.py                                  |  1 +
 lms/lms/utils.py                              | 33 ++++++-----
 8 files changed, 86 insertions(+), 21 deletions(-)
 create mode 100644 lms/auth.py

diff --git a/frontend/src/components/CourseCardOverlay.vue b/frontend/src/components/CourseCardOverlay.vue
index 2978ef61..a357a747 100644
--- a/frontend/src/components/CourseCardOverlay.vue
+++ b/frontend/src/components/CourseCardOverlay.vue
@@ -216,7 +216,7 @@ const video_link = computed(() => {
 
 function enrollStudent() {
 	if (!user.data) {
-		toast.success(__('You need to login first to enroll for this course'))
+		toast.warning(__('You need to login first to enroll for this course'))
 		setTimeout(() => {
 			window.location.href = `/login?redirect-to=${window.location.pathname}`
 		}, 500)
diff --git a/frontend/src/components/LiveClass.vue b/frontend/src/components/LiveClass.vue
index 3ee8b91a..fffbd23a 100644
--- a/frontend/src/components/LiveClass.vue
+++ b/frontend/src/components/LiveClass.vue
@@ -107,7 +107,11 @@
 		v-model:reloadLiveClasses="liveClasses"
 	/>
 
-	<LiveClassAttendance v-model="showAttendance" :live_class="attendanceFor" />
+	<LiveClassAttendance
+		v-if="showAttendance"
+		v-model="showAttendance"
+		:live_class="attendanceFor"
+	/>
 </template>
 <script setup>
 import { createListResource, Button, Tooltip } from 'frappe-ui'
diff --git a/frontend/src/components/UpcomingEvaluations.vue b/frontend/src/components/UpcomingEvaluations.vue
index 6bb0e8ec..dc93519d 100644
--- a/frontend/src/components/UpcomingEvaluations.vue
+++ b/frontend/src/components/UpcomingEvaluations.vue
@@ -190,7 +190,7 @@ const evaluationCourses = computed(() => {
 
 const canScheduleEvals = computed(() => {
 	return (
-		upcoming_evals.data?.length != evaluationCourses.length &&
+		upcoming_evals.data?.length != evaluationCourses.value?.length &&
 		!props.forHome &&
 		!endDateHasPassed.value
 	)
diff --git a/frontend/src/pages/Courses.vue b/frontend/src/pages/Courses.vue
index 06b7d765..8c1f91ae 100644
--- a/frontend/src/pages/Courses.vue
+++ b/frontend/src/pages/Courses.vue
@@ -205,7 +205,7 @@ const identifyUserPersona = async () => {
 
 const getCourseCount = () => {
 	if (!user.data) return
-
+	if (!user.data.is_moderator) return
 	call('frappe.client.get_count', {
 		doctype: 'LMS Course',
 	}).then((data) => {
diff --git a/frontend/src/pages/JobForm.vue b/frontend/src/pages/JobForm.vue
index 3b850371..1fb6b861 100644
--- a/frontend/src/pages/JobForm.vue
+++ b/frontend/src/pages/JobForm.vue
@@ -86,7 +86,7 @@
 						<Uploader
 							v-model="job.company_logo"
 							:label="__('Company Logo')"
-							:required="false"
+							:required="true"
 						/>
 					</div>
 				</div>
diff --git a/lms/auth.py b/lms/auth.py
new file mode 100644
index 00000000..f4da21dd
--- /dev/null
+++ b/lms/auth.py
@@ -0,0 +1,59 @@
+import frappe
+
+ALLOWED_PATHS = [
+	"/api/method/ping",
+	"/api/method/login",
+	"/api/method/logout",
+	"/api/method/frappe.core.doctype.communication.email.mark_email_as_seen",
+	"/api/method/frappe.realtime.get_user_info",
+	"/api/method/frappe.realtime.can_subscribe_doc",
+	"/api/method/frappe.realtime.can_subscribe_doctype",
+	"/api/method/frappe.realtime.has_permission",
+	"/api/method/frappe.integrations.oauth2.authorize",
+	"/api/method/frappe.integrations.oauth2.approve",
+	"/api/method/frappe.integrations.oauth2.get_token",
+	"/api/method/frappe.integrations.oauth2.openid_profile",
+	"/api/method/frappe.website.doctype.web_page_view.web_page_view.make_view_log",
+	"/api/method/upload_file",
+	"/api/method/frappe.search.web_search",
+	"/api/method/frappe.email.queue.unsubscribe",
+	"/api/method/frappe.website.doctype.web_form.web_form.accept",
+	"/api/method/frappe.core.doctype.user.user.test_password_strength",
+	"/api/method/frappe.core.doctype.user.user.update_password",
+	"/api/method/frappe.utils.telemetry.pulse.client.is_enabled",
+	"/api/method/frappe.client.get_value",
+	"/api/method/frappe.client.get_count",
+	"/api/method/frappe.client.get",
+	"/api/method/frappe.client.insert",
+	"/api/method/frappe.client.set_value",
+	"/api/method/frappe.client.delete",
+	"/api/method/frappe.client.get_list",
+	"/api/method/frappe.client.rename_doc",
+	"/api/method/frappe.onboarding.get_onboarding_status",
+	"/api/method/frappe.utils.print_format.download_pdf",
+	"/api/method/frappe.desk.search.search_link",
+	"/api/method/frappe.core.doctype.communication.email.make_email",
+]
+
+
+def authenticate():
+	if frappe.form_dict.cmd:
+		path = f"/api/method/{frappe.form_dict.cmd}"
+	else:
+		path = frappe.request.path
+
+	user_type = frappe.get_cached_value("User", frappe.session.user, "user_type")
+
+	if user_type == "System User":
+		return
+
+	if not path.startswith("/api/"):
+		return
+
+	if path.startswith("/lms") or path.startswith("/api/method/lms."):
+		return
+
+	print(ALLOWED_PATHS)
+	if path in ALLOWED_PATHS:
+		return
+	frappe.throw(f"Access not allowed for this URL: {path}", frappe.PermissionError)
diff --git a/lms/hooks.py b/lms/hooks.py
index aeb2e4b2..9c3a815b 100644
--- a/lms/hooks.py
+++ b/lms/hooks.py
@@ -262,3 +262,4 @@ add_to_apps_screen = [
 ]
 
 sqlite_search = ["lms.sqlite.LearningSearch"]
+auth_hooks = ["lms.auth.authenticate"]
diff --git a/lms/lms/utils.py b/lms/lms/utils.py
index 9cd9a516..166745ca 100644
--- a/lms/lms/utils.py
+++ b/lms/lms/utils.py
@@ -590,32 +590,24 @@ def get_chart_date_range(from_date, to_date):
 
 def get_chart_filters(doctype, chart, datefield, from_date, to_date):
 	version = get_frappe_version()
-	if version.startswith("16."):
-		filters = [([chart.document_type, "docstatus", "<", 2])]
-		filters = filters + json.loads(chart.filters_json)
-		filters.append([doctype, datefield, ">=", from_date])
-		filters.append([doctype, datefield, "<=", to_date])
-	else:
+	if version.startswith("15.") or version.startswith("14."):
 		filters = [([chart.document_type, "docstatus", "<", 2, False])]
 		filters = filters + json.loads(chart.filters_json)
 		filters.append([doctype, datefield, ">=", from_date, False])
 		filters.append([doctype, datefield, "<=", to_date, False])
+	else:
+		filters = [([chart.document_type, "docstatus", "<", 2])]
+		filters = filters + json.loads(chart.filters_json)
+		filters.append([doctype, datefield, ">=", from_date])
+		filters.append([doctype, datefield, "<=", to_date])
+
 	return filters
 
 
 def get_chart_details(doctype, datefield, value_field, chart, from_date, to_date):
 	filters = get_chart_filters(doctype, chart, datefield, from_date, to_date)
 	version = get_frappe_version()
-	if version.startswith("16."):
-		return frappe.db.get_all(
-			doctype,
-			fields=[datefield, {"SUM": value_field}, {"COUNT": "*"}],
-			filters=filters,
-			group_by=datefield,
-			order_by=datefield,
-			as_list=True,
-		)
-	else:
+	if version.startswith("15.") or version.startswith("14."):
 		return frappe.db.get_all(
 			doctype,
 			fields=[f"{datefield} as _unit", f"SUM({value_field})", "COUNT(*)"],
@@ -624,6 +616,15 @@ def get_chart_details(doctype, datefield, value_field, chart, from_date, to_date
 			order_by="_unit asc",
 			as_list=True,
 		)
+	else:
+		return frappe.db.get_all(
+			doctype,
+			fields=[datefield, {"SUM": value_field}, {"COUNT": "*"}],
+			filters=filters,
+			group_by=datefield,
+			order_by=datefield,
+			as_list=True,
+		)
 
 
 @frappe.whitelist(allow_guest=True)