Retire DB-stored, Desk-editable Server Scripts: scripts directory on the file system
Author: AarDG10Created Sep 16, 2026Updated Sep 17, 2026
- id: M-227
- Valid: Yes
- type: Security hardening
- area: Customization & scripting
- breaking: Yes: Server Script editing leaves Desk (switch for the DB-based flow during transition); scripts calling arbitrary document methods break
- size: XL
- signal: High
- sources: ISS,GP
- source_count: 2
- status: not started (framework lead: MUST for v17; spec to be redone 2026-09; server scripts disabled by default since v15)
- summary: Server scripts in the DB can be changed through the API and were used in a 2026 breach (print format to server script chain). Move script code to a site scripts folder (doctype_events, api, cron) that only server access can edit and that is included in backups; apply the same idea to reports, print templates and email templates. Conflicts with support demand to enable scripts on shared hosting (see D-5).
- refs: GP-1: GP#5785, GP#5712, GP#4853, GP#2430 | ISS-46: #26385, #39600
Source: frappe/frappe