fix: validate fieldname in get_group_by_count (frappe#21932)

* fix: validate fieldname in get_group_by_count

* test: call get_group_by_count with invalid field

* test: is_default_field

frappe/desk/listview.py

@@ -2,6 +2,7 @@
 # License: MIT. See LICENSE
 
 import frappe
+from frappe.model import is_default_field
 from frappe.query_builder import Order
 from frappe.query_builder.functions import Count
 from frappe.query_builder.terms import SubQuery
@@ -59,6 +60,9 @@ def get_group_by_count(doctype: str, current_filters: str, field: str) -> list[d
 			.run(as_dict=True)
 		)
 
+	if not frappe.get_meta(doctype).has_field(field) and not is_default_field(field):
+		raise ValueError("Field does not belong to doctype")
+
 	return frappe.get_list(
 		doctype,
 		filters=current_filters,

frappe/model/__init__.py

@@ -225,3 +225,7 @@ def get_permitted_fields(
 		return meta_fields + permitted_fields + optional_meta_fields
 
 	return []
+
+
+def is_default_field(fieldname: str) -> bool:
+	return fieldname in default_fields

frappe/tests/test_listview.py

@@ -71,6 +71,15 @@ def test_list_view_child_table_filter_with_created_by_filter(self):
 		}
 		self.assertEqual(data["Administrator"], 1)
 
+	def test_get_group_by_invalid_field(self):
+		self.assertRaises(
+			ValueError,
+			get_group_by_count,
+			"Note",
+			'[["Note Seen By","user","=","Administrator"]]',
+			"invalid_field",
+		)
+
 	def test_list_view_comment_count(self):
 		frappe.form_dict.doctype = "DocType"
 		frappe.form_dict.limit = "1"

frappe/tests/test_model_utils.py

@@ -2,7 +2,7 @@
 from random import choice
 
 import frappe
-from frappe.model import core_doctypes_list, get_permitted_fields
+from frappe.model import core_doctypes_list, get_permitted_fields, is_default_field
 from frappe.model.utils import get_fetch_values
 from frappe.tests.utils import FrappeTestCase
 
@@ -66,6 +66,16 @@ def test_get_permitted_fields(self):
 				get_permitted_fields("Installed Application", parenttype="Installed Applications"), []
 			)
 
+	def test_is_default_field(self):
+		self.assertTrue(is_default_field("doctype"))
+		self.assertTrue(is_default_field("name"))
+		self.assertTrue(is_default_field("owner"))
+
+		self.assertFalse(is_default_field({}))
+		self.assertFalse(is_default_field("qwerty1234"))
+		self.assertFalse(is_default_field(True))
+		self.assertFalse(is_default_field(42))
+
 
 @contextmanager
 def set_user(user: str):