Odoo Help


Problem with security and ir_attachment

Evans Bernier
on 7/10/16, 5:16 PM 1,843 views


I created a website module that can access at some attachments. I create a security group for my module and gave reading access to ir_attachment model. The user of this module can only access frontend. When I try to show attribute of an attachment from ir_attachment, I got a "500: Internal Server Error". In log, I can see the following error message

File "/var/www/odoo8/server/openerp/addons/base/ir/ir_attachment.py", line 259, in check

    raise except_orm(_('Access Denied'), _("Sorry, you are not allowed to access this document."))

I looked in security and my security group have access to the model. Why I get this error message?

If the user have at least access to backend, I can access ir_attachment, but not if the user have only access frontend.



Axel Mendoza

--Axel Mendoza--
| 7 8 8
Camaguey, Cuba
--Axel Mendoza--

DevOps - Full stack - Software Architect - Developer - Technology Integrator

I could help you to develop anything and solve complex problems based on technologies, integrations and tricky stuffs mostly in Python with OpenERP/Odoo, Zato, Django and many others frameworks programming languages and technologies.

I offers consulting services to anyone with an unanswered questions or needs for customizations. Think about it, maybe it's better to have an expert to solve your issues and projects than having a full-time employee trying to understand what to do and how

Reach me at aekroft@gmail.com

Axel Mendoza
On 7/10/16, 9:02 PM

Hi Evans Bernier

The issue is related that the ir.attachment model has an override of the check method to add extra security checks and the particular one that you are hitting is that the user that you are using doesn't have the group Employee that it's not an HR security group, it's a base group assigned by default to pretty much all the users created, seems that your user was created using the signup feature of Odoo that use the Public User as a template and that way the new users does not get the Employee group since the template user doesn't have it neither. You could find the Employee group in the Human Resources group selection field in the user form, where all of the other values for that selection field are groups that inherit from the Employee group. You could also put your new group to inherit from the Employee group (ID is base.group_user) or manually add that group to the user and you will be ok

*** Update ***

The easiest way to solve that without giving aditional permissions to your users is doing this:

from openerp import models

class ir_attachment_check(models.Model)

_inherit = 'ir.attachment'

def check(self, cr, uid, ids, mode, context=None, values=None):

res_ids = {}

if ids:

if isinstance(ids, (int, long)):

ids = [ids]

cr.execute('SELECT DISTINCT res_model, res_id, create_uid FROM ir_attachment WHERE id = ANY (%s)', (ids,))

for rmod, rid, create_uid in cr.fetchall():

if not (rmod and rid):



if values:

if values.get('res_model') and values.get('res_id'):


ima = self.pool.get('ir.model.access')

for model, mids in res_ids.items():

# ignore attachments that are not attached to a resource anymore when checking access rights

# (resource was deleted but attachment was not)

if not self.pool.get(model):


existing_ids = self.pool[model].exists(cr, uid, mids)

ima.check(cr, uid, model, mode)

self.pool[model].check_access_rule(cr, uid, existing_ids, mode, context=context)

Just override the check method to remove the code that checks for the Employee  group in the user

Hi Axel,

Thanks a lot for the explanation. I don't want to give access to backend to these users. How can I give that rights without giving the backend access?


Evans Bernier
on 7/10/16, 10:27 PM

See my answer update for how to do it and don't forget to upvote and accept the answer if you find it useful

Axel Mendoza
on 7/10/16, 11:56 PM
Alexey Moujeer
On 1/13/18, 11:40 PM

I scratched my head for quite some time over this error when I tried to make some attachments accessible from a public website (read only). In odoo10 - and I don't know about earlier versions - setting the "public" field on the attachment to True makes the check method bypass the aforementioned security check in read mode.

Evans Bernier
On 7/11/16, 9:42 AM

Thanks Axel, that's work fine. I wasn't know about the extra security checks of that model.

About This Community

This platform is for beginners and experts willing to share their Odoo knowledge. It's not a forum to discuss ideas, but a knowledge base of questions and their answers.


Odoo Training Center

Access to our E-learning platform and experience all Odoo Apps through learning videos, exercises and Quizz.

Test it now

Question tools

1 follower(s)


Asked: 7/10/16, 5:16 PM
Seen: 1843 times
Last updated: 1/13/18, 11:40 PM