Odoo Help

0

Problem with security and ir_attachment

By
Evans Bernier
on 7/10/16, 5:16 PM 973 views

Hello,

I created a website module that can access at some attachments. I create a security group for my module and gave reading access to ir_attachment model. The user of this module can only access frontend. When I try to show attribute of an attachment from ir_attachment, I got a "500: Internal Server Error". In log, I can see the following error message

File "/var/www/odoo8/server/openerp/addons/base/ir/ir_attachment.py", line 259, in check

    raise except_orm(_('Access Denied'), _("Sorry, you are not allowed to access this document."))

I looked in security and my security group have access to the model. Why I get this error message?

If the user have at least access to backend, I can access ir_attachment, but not if the user have only access frontend.

Thanks


2
Axel Mendoza
On 7/10/16, 9:02 PM

Hi Evans Bernier

The issue is related that the ir.attachment model has an override of the check method to add extra security checks and the particular one that you are hitting is that the user that you are using doesn't have the group Employee that it's not an HR security group, it's a base group assigned by default to pretty much all the users created, seems that your user was created using the signup feature of Odoo that use the Public User as a template and that way the new users does not get the Employee group since the template user doesn't have it neither. You could find the Employee group in the Human Resources group selection field in the user form, where all of the other values for that selection field are groups that inherit from the Employee group. You could also put your new group to inherit from the Employee group (ID is base.group_user) or manually add that group to the user and you will be ok


*** Update ***

The easiest way to solve that without giving aditional permissions to your users is doing this:


from openerp import models

class ir_attachment_check(models.Model)

_inherit = 'ir.attachment'

def check(self, cr, uid, ids, mode, context=None, values=None):

res_ids = {}

if ids:

if isinstance(ids, (int, long)):

ids = [ids]

cr.execute('SELECT DISTINCT res_model, res_id, create_uid FROM ir_attachment WHERE id = ANY (%s)', (ids,))

for rmod, rid, create_uid in cr.fetchall():

if not (rmod and rid):

continue

res_ids.setdefault(rmod,set()).add(rid)

if values:

if values.get('res_model') and values.get('res_id'):

res_ids.setdefault(values['res_model'],set()).add(values['res_id'])

ima = self.pool.get('ir.model.access')

for model, mids in res_ids.items():

# ignore attachments that are not attached to a resource anymore when checking access rights

# (resource was deleted but attachment was not)

if not self.pool.get(model):

continue

existing_ids = self.pool[model].exists(cr, uid, mids)

ima.check(cr, uid, model, mode)

self.pool[model].check_access_rule(cr, uid, existing_ids, mode, context=context)

Just override the check method to remove the code that checks for the Employee  group in the user

Hi Axel,

Thanks a lot for the explanation. I don't want to give access to backend to these users. How can I give that rights without giving the backend access?

Thanks,

Evans Bernier
on 7/10/16, 10:27 PM

See my answer update for how to do it and don't forget to upvote and accept the answer if you find it useful

Axel Mendoza
on 7/10/16, 11:56 PM
0
Evans Bernier
On 7/11/16, 9:42 AM

Thanks Axel, that's work fine. I wasn't know about the extra security checks of that model.

About This Community

This platform is for beginners and experts willing to share their Odoo knowledge. It's not a forum to discuss ideas, but a knowledge base of questions and their answers.

Register

Odoo Training Center

Access to our E-learning platform and experience all Odoo Apps through learning videos, exercises and Quizz.

Test it now

Question tools

1 follower(s)

Stats

Asked: 7/10/16, 5:16 PM
Seen: 973 times
Last updated: 7/11/16, 9:42 AM