[IMP] base: add public field on attachment

addons/web_editor/controllers/main.py

@@ -145,6 +145,7 @@ class Web_Editor(http.Controller):
                 'name': name,
                 'type': 'url',
                 'url': url,
+                'public': True,
                 'res_model': 'ir.ui.view',
             }, request.context)
             uploads += Attachments.read(request.cr, request.uid, [attachment_id], ['name', 'mimetype', 'checksum', 'url'], request.context)
@@ -169,6 +170,7 @@ class Web_Editor(http.Controller):
                         'name': c_file.filename,
                         'datas': data.encode('base64'),
                         'datas_fname': c_file.filename,
+                        'public': True,
                         'res_model': 'ir.ui.view',
                     }, request.context)
                     attachment_ids.append(attachment_id)

openerp/addons/base/ir/ir_attachment.py

@@ -290,6 +290,7 @@ class ir_attachment(osv.osv):
         'checksum': fields.char("Checksum/SHA1", size=40, select=True, readonly=True),
         'mimetype': fields.char('Mime Type', readonly=True),
         'index_content': fields.text('Indexed Content', readonly=True),
+        'public': fields.boolean('Is public document'),
     }
 
     _defaults = {
@@ -316,8 +317,10 @@ class ir_attachment(osv.osv):
         if ids:
             if isinstance(ids, (int, long)):
                 ids = [ids]
-            cr.execute('SELECT DISTINCT res_model, res_id, create_uid FROM ir_attachment WHERE id = ANY (%s)', (ids,))
-            for rmod, rid, create_uid in cr.fetchall():
+            cr.execute('SELECT res_model, res_id, create_uid, public FROM ir_attachment WHERE id = ANY (%s)', (ids,))
+            for rmod, rid, create_uid, public in cr.fetchall():
+                if public and mode == 'read':
+                    continue
                 if not (rmod and rid):
                     if create_uid != uid:
                         require_employee = True
@@ -368,11 +371,11 @@ class ir_attachment(osv.osv):
         # the linked document.
         # Use pure SQL rather than read() as it is about 50% faster for large dbs (100k+ docs),
         # and the permissions are checked in super() and below anyway.
-        cr.execute("""SELECT id, res_model, res_id FROM ir_attachment WHERE id = ANY(%s)""", (list(ids),))
+        cr.execute("""SELECT id, res_model, res_id, public FROM ir_attachment WHERE id = ANY(%s)""", (list(ids),))
         targets = cr.dictfetchall()
         model_attachments = {}
         for target_dict in targets:
-            if not target_dict['res_model']:
+            if not target_dict['res_model'] or target_dict['public']:
                 continue
             # model_attachments = { 'model': { 'res_id': [id1,id2] } }
             model_attachments.setdefault(target_dict['res_model'],{}).setdefault(target_dict['res_id'] or 0, set()).add(target_dict['id'])

openerp/addons/base/ir/ir_attachment_view.xml

@@ -24,6 +24,7 @@
                             <field name="res_id"/>
                             <field name="res_name"/>
                             <field name="company_id" groups="base.group_multi_company" options="{'no_create': True}"/>
+                            <field name="public"/>
                         </group>
                         <group string="History" groups="base.group_no_one">
                             <label for="create_uid" string="Creation"/>

openerp/addons/base/ir/ir_qweb.py

@@ -1236,6 +1236,7 @@ class AssetsBundle(object):
             values["name"] = "/web/content/%s" % type
             values["datas_fname"] = '%s%s.%s' % (self.xmlid, ('' if inc is None else '.%s' % inc), type)
             values["res_model"] = 'ir.ui.view'
+            values["public"] = True
             values["type"] = 'binary'
             attachment_id = ira.create(self.cr, openerp.SUPERUSER_ID, values, context=self.context)
             url = '/web/content/%s-%s/%s' % (attachment_id, self.version, values["datas_fname"])