[FIX] base: temporary files were not correctly attached

addons/mail/wizard/mail_compose_message.py

@@ -340,9 +340,17 @@ class MailComposer(models.TransientModel):
                 'subject': record.subject or False,
                 'body_html': record.body or False,
                 'model_id': model.id or False,
-                'attachment_ids': [Command.set(record.attachment_ids.ids)],
             }
             template = self.env['mail.template'].create(values)
+
+            if record.attachment_ids:
+                # transfer pending attachments to the new template
+                attachments = self.env['ir.attachment'].sudo().browse(record.attachment_ids).filtered(
+                    lambda a: a.res_model == 'mail.compose.message' and a.create_uid.id == self._uid)
+                if attachments:
+                    attachments.write({'res_model': template._name, 'res_id': template.id})
+                template.attachment_ids |= record.attachment_ids
+
             # generate the saved template
             record.write({'template_id': template.id})
             record._onchange_template_id_wrapper()

addons/test_mail/tests/test_mail_composer.py

@@ -69,10 +69,17 @@ class TestMailComposer(TestMailCommon, TestRecipients):
             'auto_delete': True,
         })
 
-    def _generate_attachments_data(self, count):
+    def _generate_attachments_data(self, count, res_model=None, res_id=None):
+        # attachment visibility depends on what they are attached to
+        if res_model is None:
+            res_model = self.template._name
+        if res_id is None:
+            res_id = self.template.id
         return [{
             'name': '%02d.txt' % x,
             'datas': base64.b64encode(b'Att%02d' % x),
+            'res_model': res_model,
+            'res_id': res_id,
         } for x in range(count)]
 
     def _get_web_context(self, records, add_web=True, **values):

addons/test_mail/tests/test_mail_message.py

@@ -293,7 +293,9 @@ class TestMessageAccess(TestMailCommon):
     def test_mail_message_access_read_notification(self):
         attachment = self.env['ir.attachment'].create({
             'datas': base64.b64encode(b'My attachment'),
-            'name': 'doc.txt'})
+            'name': 'doc.txt',
+            'res_model': self.message._name,
+            'res_id': self.message.id})
         # attach the attachment to the message
         self.message.write({'attachment_ids': [(4, attachment.id)]})
         self.message.write({'partner_ids': [(4, self.user_employee.partner_id.id)]})

odoo/addons/base/models/ir_attachment.py

@@ -437,10 +437,10 @@ class IrAttachment(models.Model):
             self.env['ir.attachment'].flush(['res_model', 'res_id', 'create_uid', 'public', 'res_field'])
             self._cr.execute('SELECT res_model, res_id, create_uid, public, res_field FROM ir_attachment WHERE id IN %s', [tuple(self.ids)])
             for res_model, res_id, create_uid, public, res_field in self._cr.fetchall():
-                if not self.env.is_system() and res_field:
-                    raise AccessError(_("Sorry, you are not allowed to access this document."))
                 if public and mode == 'read':
                     continue
+                if not self.env.is_system() and (res_field or (not res_id and create_uid != self.env.uid)):
+                    raise AccessError(_("Sorry, you are not allowed to access this document."))
                 if not (res_model and res_id):
                     continue
                 model_ids[res_model].add(res_id)