⚠️ Breaking: ticket field permissions (#3930)
Customers could set agent-only ticket fields (priority, SLA, due dates) through the REST API. HD Ticket fields now use permission levels, and Frappe enforces them on every path:
- Level 7: fields customers can read (
priority,ticket_type,agent_group,sla,raised_by,customer, …). Agents edit. - Level 8: agent-only fields (
summary,key,resolution_details,agreement_status, …). Customers can't read them. - Levels 1–6 stay free for your own permission scheme.
What changes
- After creating a ticket, customers can only close it, leave feedback and edit fields whose template row has Editable after creation ticked. It's ticked by default, including on existing rows. Any other edit raises
PermissionError. - Nobody can change
descriptiononce it is set. - In ticket templates, Hide from customer is replaced by Visible to (Everyone / Agents). Old values move across automatically.
- Visible to hides a field on helpdesk pages only. To hide it from the REST API too, raise its permission level in Customize Form.
- Ticket templates can no longer be renamed.
On update
- If your site has custom HD Ticket permission rules, a patch adds levels 7 and 8 for agent roles and level 7 read for roles that already read tickets. Level 8 is never given to your own roles: add it in Role Permission Manager for your own staff roles.
- Agent managers see a one-time notice in the sidebar.
Custom code that reads or saves tickets as a customer, or reads hide_from_customer, needs updating. See the migration guide.
Docs: Permission levels in Helpdesk
What's Changed
- fix(ticket): ticket actions hang until automatic emails are sent (backport #3884) by @mergify[bot] in #3923
- fix(ticket): match inline images pasted with the site's absolute URL (backport #3924) by @mergify[bot] in #3929
- fix(auth): let MCP clients through block_endpoints (backport #3921) by @mergify[bot] in #3928
- fix(list): show datetime columns as relative time (backport #3199) by @aerodeval in #3935
- fix(dashboard): count the period up to the site's today by @aerodeval in #3936
- fix: get UI tests passing on frappe v16 by @aerodeval in #3931
- fix!: field-level permissions for agent-only ticket fields (backport #3544) by @aerodeval in #3930
- fix(editor): keep blank lines and spaces typed in the editor (backport #3904) by @mergify[bot] in #3927
- fix(settings): show email under the name on profile by @aerodeval in #3941
Full Changelog: v1.31.0...v1.31.1