Able to access any employee field without considering permissions #3765
Description
Information about bug
There is an API endpoint that can leak any value from the Employee doctype to Desk/Website users while skipping all the permission checks.
The issue is on this line: https://github.com/frappe/hrms/blob/develop/hrms/hr/utils.py#L174
Module
HR
Version
It is reproducible on all versions
Installation method
docker
Relevant log output / Stack trace / Full Error Message.
Code of Conduct
- I agree to follow this project's Code of Conduct