[URGENT] Prevent accessing sensitive files in client.get_js
[URGENT] Prevent accessing sensitive files in client.get_js

Logged in user (any permissions) can access sensitive files by calling frappe.client.get_js

Consider the following scenario:
1- Login to system
2- http://HOST/?items=["currentsite.txt"]&cmd=frappe.client.get_js  (this will give you site directory name)
3- http://HOST/?items=["SITE_DIR_NAME%2Fsite_config.json"]&cmd=frappe.client.get_js (this will show you site config including database name and password and any other sensitive data

The suggested fix prevent accessing any file outside the assets folder. (or atleast you should prevent access to .py files and private folder which includes backup and sensetive files and logs folders)

There should be a hot fix asap
frappe/frappe,manassolanki/frappe,bcornwellmott/frappe,tundebabzy/frappe,neilLasrado/frappe,ESS-LLP/frappe,almeidapaulopt/frappe,bcornwellmott/frappe,rmehta/frappe,mbauskar/frappe,saurabh6790/frappe,neilLasrado/frappe,rmehta/frappe,RicardoJohann/frappe,rmehta/frappe,tmimori/frappe,mhbu50/frappe,frappe/frappe,vjFaLk/frappe,StrellaGroup/frappe,maxtorete/frappe,yashodhank/frappe,vjFaLk/frappe,tundebabzy/frappe,yashodhank/frappe,neilLasrado/frappe,chdecultot/frappe,manassolanki/frappe,bohlian/frappe,tundebabzy/frappe,paurosello/frappe,adityahase/frappe,RicardoJohann/frappe,chdecultot/frappe,mhbu50/frappe,elba7r/builder,yashodhank/frappe,tmimori/frappe,paurosello/frappe,saurabh6790/frappe,rohitwaghchaure/frappe,adityahase/frappe,almeidapaulopt/frappe,elba7r/frameworking,bohlian/frappe,elba7r/builder,elba7r/builder,StrellaGroup/frappe,bcornwellmott/frappe,rohitwaghchaure/frappe,rohitwaghchaure/frappe,rmehta/frappe,saurabh6790/frappe,ESS-LLP/frappe,frappe/frappe,manassolanki/frappe,neilLasrado/frappe,chdecultot/frappe,almeidapaulopt/frappe,mbauskar/frappe,tmimori/frappe,tmimori/frappe,RicardoJohann/frappe,maxtorete/frappe,elba7r/builder,elba7r/frameworking,adityahase/frappe,adityahase/frappe,yashodhank/frappe,bcornwellmott/frappe,ESS-LLP/frappe,elba7r/frameworking,mhbu50/frappe,rohitwaghchaure/frappe,saurabh6790/frappe,bohlian/frappe,vjFaLk/frappe,paurosello/frappe,mhbu50/frappe,mbauskar/frappe,bohlian/frappe,RicardoJohann/frappe,elba7r/frameworking,mbauskar/frappe,almeidapaulopt/frappe,chdecultot/frappe,StrellaGroup/frappe,ESS-LLP/frappe,manassolanki/frappe,paurosello/frappe,tundebabzy/frappe,maxtorete/frappe,maxtorete/frappe,vjFaLk/frappe