From a5baf82ddc9d5c6df9fa7023a3f36405bf6e4e9e Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Thu, 18 Sep 2025 18:21:01 +0300
Subject: [PATCH] catch forbidden

---
 application/Espo/Core/Record/Service.php | 27 +++++++++++++++---------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/application/Espo/Core/Record/Service.php b/application/Espo/Core/Record/Service.php
index 260859b946..47e0f20b91 100644
--- a/application/Espo/Core/Record/Service.php
+++ b/application/Espo/Core/Record/Service.php
@@ -59,7 +59,6 @@ use Espo\Core\Record\Input\Data;
 use Espo\Core\Record\Input\Filter;
 use Espo\Core\Record\Input\FilterProvider;
 use Espo\Core\Select\Primary\Filters\One;
-use Espo\Core\Select\SelectBuilder;
 use Espo\Core\Select\SelectBuilderFactory;
 use Espo\Core\Utils\Json;
 use Espo\Core\Acl;
@@ -896,14 +895,18 @@ class Service implements Crud,
 
         $preparedSearchParams = $this->prepareSearchParams($searchParams);
 
-        $query = $this->selectBuilderFactory->create()
-            ->from($this->entityType)
-            ->withStrictAccessControl()
-            ->withSearchParams($preparedSearchParams)
-            ->withAdditionalApplierClassNameList(
-                $this->createSelectApplierClassNameListProvider()->get($this->entityType)
-            )
-            ->build();
+        try {
+            $query = $this->selectBuilderFactory->create()
+                ->from($this->entityType)
+                ->withStrictAccessControl()
+                ->withSearchParams($preparedSearchParams)
+                ->withAdditionalApplierClassNameList(
+                    $this->createSelectApplierClassNameListProvider()->get($this->entityType)
+                )
+                ->build();
+        } catch (Forbidden $e) {
+            throw new BadRequest($e->getMessage(), 400, $e);
+        }
 
         $collection = $this->getRepository()
             ->clone($query)
@@ -1079,7 +1082,11 @@ class Service implements Crud,
             $selectBuilder->withWherePermissionCheck();
         }
 
-        $query = $selectBuilder->build();
+        try {
+            $query = $selectBuilder->build();
+        } catch (Forbidden $e) {
+            throw new BadRequest($e->getMessage(), 400, $e);
+        }
 
         $collection = $this->entityManager
             ->getRDBRepository($this->entityType)