From a97abef2d27521b7fbba2e9ea47dfc9233c0e014 Mon Sep 17 00:00:00 2001
From: tsm-odoo <tsm@odoo.com>
Date: Fri, 6 Oct 2023 16:31:17 +0200
Subject: [PATCH] [IMP] im_livechat, mail: allow livechat visitors to upload
 attachments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since [1], live chat visitors are using the mail guest system for
authentication. With this change, visitors are allowed to reach the
attachment upload routes (even if nothing allows it in the frontend
for now). This commit restricts attachment upload for guest and portal
users with the `allow_visitor_upload` field that can be toggled.

At the same time, this commit enables file upload when authorized
on the frontend and for cross origin live chats.

[1]: odoo#129770

task-3332628

closes odoo/odoo#137574

Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
---
 addons/im_livechat/__manifest__.py            |  1 +
 addons/im_livechat/controllers/__init__.py    |  1 +
 addons/im_livechat/controllers/attachment.py  | 22 ++++++++
 .../im_livechat/controllers/cors/__init__.py  |  2 +
 .../controllers/cors/attachment.py            | 15 ++++++
 addons/im_livechat/controllers/cors/binary.py | 33 ++++++++++++
 .../im_livechat/controllers/cors/webclient.py |  2 +-
 .../static/src/composer/composer_patch.js     |  4 --
 .../src/embed/core/disabled_features.js       | 17 ++-----
 .../src/embed/core/thread_model_patch.js      | 23 ++++++---
 .../src/embed/cors/attachment_model_patch.js  | 21 ++++++++
 .../cors/attachment_upload_service_patch.js   | 17 +++++++
 .../src/embed/cors/livechat_routing_map.js    |  1 +
 .../static/tests/composer_patch_tests.js      | 35 +------------
 addons/im_livechat/tests/__init__.py          |  1 +
 .../tests/test_upload_attachment.py           | 36 +++++++++++++
 .../views/im_livechat_channel_templates.xml   |  4 +-
 addons/mail/controllers/attachment.py         | 10 ++--
 addons/mail/models/discuss/discuss_channel.py |  2 +
 addons/mail/models/discuss/ir_attachment.py   | 15 +-----
 addons/mail/models/ir_attachment.py           |  4 --
 addons/mail/models/mail_thread.py             |  6 ++-
 .../core/common/attachment_upload_service.js  |  6 ++-
 .../mail/static/src/core/common/composer.js   | 19 ++++---
 .../static/src/core/common/dropzone_hook.js   |  4 +-
 .../discuss/core/common/attachment_panel.js   | 21 +++++++-
 .../discuss/core/common/attachment_panel.xml  |  7 +++
 .../common/attachment_upload_service_patch.js | 24 +++++++++
 .../src/discuss/core/common/composer_patch.js | 16 ++++++
 .../discuss/core/common/thread_model_patch.js |  4 ++
 .../discuss/core/attachment_panel_tests.js    | 20 ++++++++
 .../mock_server/models/discuss_channel.js     |  1 +
 .../mock_server/models/mail_message.js        |  2 +-
 .../helpers/mock_server/models/res_partner.js |  1 +
 addons/mail/tests/discuss/__init__.py         |  1 +
 .../discuss/test_discuss_channel_as_guest.py  |  2 +
 .../mail/tests/discuss/test_toggle_upload.py  | 51 +++++++++++++++++++
 .../tests/test_performance.py                 | 12 +++++
 .../static/src/views/fields/file_handler.js   |  3 +-
 39 files changed, 369 insertions(+), 97 deletions(-)
 create mode 100644 addons/im_livechat/controllers/attachment.py
 create mode 100644 addons/im_livechat/controllers/cors/attachment.py
 create mode 100644 addons/im_livechat/controllers/cors/binary.py
 create mode 100644 addons/im_livechat/static/src/embed/cors/attachment_model_patch.js
 create mode 100644 addons/im_livechat/static/src/embed/cors/attachment_upload_service_patch.js
 create mode 100644 addons/im_livechat/tests/test_upload_attachment.py
 create mode 100644 addons/mail/static/src/discuss/core/common/attachment_upload_service_patch.js
 create mode 100644 addons/mail/static/src/discuss/core/common/composer_patch.js
 create mode 100644 addons/mail/tests/discuss/test_toggle_upload.py

diff --git a/addons/im_livechat/__manifest__.py b/addons/im_livechat/__manifest__.py
index 5e7bbebda10..c79a7e56b3f 100644
--- a/addons/im_livechat/__manifest__.py
+++ b/addons/im_livechat/__manifest__.py
@@ -124,6 +124,7 @@ Help your customers with this chat, and analyse their feedback.
             'web/static/src/libs/pdfjs.js',
             'web/static/src/views/fields/formatters.js',
             'web/static/src/views/fields/file_handler.*',
+            'web/static/src/scss/mimetypes.scss',
             'bus/static/src/*.js',
             'bus/static/src/services/**/*.js',
             'bus/static/src/workers/websocket_worker.js',
diff --git a/addons/im_livechat/controllers/__init__.py b/addons/im_livechat/controllers/__init__.py
index bf729810686..29228c6c1c8 100644
--- a/addons/im_livechat/controllers/__init__.py
+++ b/addons/im_livechat/controllers/__init__.py
@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+from . import attachment
 from . import chatbot
 from . import main
 from . import webclient
diff --git a/addons/im_livechat/controllers/attachment.py b/addons/im_livechat/controllers/attachment.py
new file mode 100644
index 00000000000..4caa39d7d92
--- /dev/null
+++ b/addons/im_livechat/controllers/attachment.py
@@ -0,0 +1,22 @@
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import _
+from odoo.http import route, request
+from odoo.addons.mail.controllers.attachment import AttachmentController
+from odoo.exceptions import AccessError
+from odoo.addons.mail.models.discuss.mail_guest import add_guest_to_context
+
+
+class LivechatAttachmentController(AttachmentController):
+    @route()
+    @add_guest_to_context
+    def mail_attachment_upload(self, ufile, thread_id, thread_model, is_pending=False, **kwargs):
+        thread = request.env[thread_model]._get_from_context_or_raise(int(thread_id))
+        if (
+            thread_model == "discuss.channel"
+            and thread.channel_type == "livechat"
+            and not thread.livechat_active
+            and not request.env.user._is_internal()
+        ):
+            raise AccessError(_("You are not allowed to upload attachments on this channel."))
+        return super().mail_attachment_upload(ufile, thread_id, thread_model, is_pending, **kwargs)
diff --git a/addons/im_livechat/controllers/cors/__init__.py b/addons/im_livechat/controllers/cors/__init__.py
index 2389fd39d69..96b7454e235 100644
--- a/addons/im_livechat/controllers/cors/__init__.py
+++ b/addons/im_livechat/controllers/cors/__init__.py
@@ -1,5 +1,7 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+from . import attachment
+from . import binary
 from . import channel
 from . import link_preview
 from . import main
diff --git a/addons/im_livechat/controllers/cors/attachment.py b/addons/im_livechat/controllers/cors/attachment.py
new file mode 100644
index 00000000000..2d2fabf156c
--- /dev/null
+++ b/addons/im_livechat/controllers/cors/attachment.py
@@ -0,0 +1,15 @@
+from odoo.http import route
+from odoo.addons.mail.controllers.attachment import AttachmentController
+from odoo.addons.im_livechat.tools.misc import force_guest_env
+
+
+class LivechatAttachmentController(AttachmentController):
+    @route("/im_livechat/cors/attachment/upload", auth="public", cors="*", csrf=False)
+    def im_livechat_attachment_upload(self, guest_token, ufile, thread_id, thread_model, is_pending=False, **kwargs):
+        force_guest_env(guest_token)
+        return self.mail_attachment_upload(ufile, thread_id, thread_model, is_pending, **kwargs)
+
+    @route("/im_livechat/cors/attachment/delete", methods=["POST"], type="json", auth="public", cors="*")
+    def im_livechat_attachment_delete(self, guest_token, attachment_id, access_token=None):
+        force_guest_env(guest_token)
+        return self.mail_attachment_delete(attachment_id, access_token)
diff --git a/addons/im_livechat/controllers/cors/binary.py b/addons/im_livechat/controllers/cors/binary.py
new file mode 100644
index 00000000000..5e55381b66a
--- /dev/null
+++ b/addons/im_livechat/controllers/cors/binary.py
@@ -0,0 +1,33 @@
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+
+from odoo.http import route
+from odoo.addons.mail.controllers.discuss.binary import BinaryController
+from odoo.addons.im_livechat.tools.misc import force_guest_env
+
+
+class LivechatBinaryController(BinaryController):
+    @route(
+        "/im_livechat/cors/channel/<int:channel_id>/attachment/<int:attachment_id>",
+        methods=["GET"],
+        type="http",
+        auth="public",
+        cors="*",
+    )
+    def livechat_channel_attachment(self, guest_token, channel_id, attachment_id, download=None, **kwargs):
+        force_guest_env(guest_token)
+        return self.discuss_channel_attachment(channel_id, attachment_id, download, **kwargs)
+
+    @route(
+        [
+            "/im_livechat/cors/channel/<int:channel_id>/image/<int:attachment_id>",
+            "/im_livechat/cors/channel/<int:channel_id>/image/<int:attachment_id>/<int:width>x<int:height>",
+        ],
+        methods=["GET"],
+        type="http",
+        auth="public",
+        cors="*"
+    )
+    def livechat_fetch_image(self, guest_token, channel_id, attachment_id, width=0, height=0, **kwargs):
+        force_guest_env(guest_token)
+        return self.fetch_image(channel_id, attachment_id, width, height, **kwargs)
diff --git a/addons/im_livechat/controllers/cors/webclient.py b/addons/im_livechat/controllers/cors/webclient.py
index 859762f0973..436413b954d 100644
--- a/addons/im_livechat/controllers/cors/webclient.py
+++ b/addons/im_livechat/controllers/cors/webclient.py
@@ -9,4 +9,4 @@ class WebClient(WebclientController):
     @route("/im_livechat/cors/init_messaging", methods=["POST"], type="json", auth="public", cors="*")
     def livechat_init_messaging(self, guest_token):
         force_guest_env(guest_token)
-        return super().mail_init_messaging()
+        return self.mail_init_messaging()
diff --git a/addons/im_livechat/static/src/composer/composer_patch.js b/addons/im_livechat/static/src/composer/composer_patch.js
index 5620709b42f..e15b764882f 100644
--- a/addons/im_livechat/static/src/composer/composer_patch.js
+++ b/addons/im_livechat/static/src/composer/composer_patch.js
@@ -5,10 +5,6 @@ import { Composer } from "@mail/core/common/composer";
 import { patch } from "@web/core/utils/patch";
 
 patch(Composer.prototype, {
-    get allowUpload() {
-        return this.thread?.type !== "livechat" && super.allowUpload;
-    },
-
     onKeydown(ev) {
         super.onKeydown(ev);
         if (
diff --git a/addons/im_livechat/static/src/embed/core/disabled_features.js b/addons/im_livechat/static/src/embed/core/disabled_features.js
index c8967f140df..25b1e7e09a8 100644
--- a/addons/im_livechat/static/src/embed/core/disabled_features.js
+++ b/addons/im_livechat/static/src/embed/core/disabled_features.js
@@ -1,7 +1,6 @@
 /* @odoo-module */
 
-import { Composer } from "@mail/core/common/composer";
-import { Store } from "@mail/core/common/store_service";
+import { messageActionsRegistry } from "@mail/core/common/message_actions";
 import { threadActionsRegistry } from "@mail/core/common/thread_actions";
 import { Thread } from "@mail/core/common/thread_model";
 import { ThreadService } from "@mail/core/common/thread_service";
@@ -9,9 +8,10 @@ import { ThreadService } from "@mail/core/common/thread_service";
 import { patch } from "@web/core/utils/patch";
 import { SESSION_STATE } from "./livechat_service";
 
-patch(Composer.prototype, {
-    get allowUpload() {
-        return false;
+const downloadFilesAction = messageActionsRegistry.get("download_files");
+patch(downloadFilesAction, {
+    condition(component) {
+        return component.message.originThread.type !== "livechat" && super.condition(component);
     },
 });
 
@@ -32,13 +32,6 @@ patch(ThreadService.prototype, {
     },
 });
 
-patch(Store.prototype, {
-    setup() {
-        super.setup(...arguments);
-        this.hasLinkPreviewFeature = false;
-    },
-});
-
 const allowedThreadActions = new Set(["fold-chat-window", "close", "restart", "settings"]);
 for (const [actionName] of threadActionsRegistry.getEntries()) {
     if (!allowedThreadActions.has(actionName)) {
diff --git a/addons/im_livechat/static/src/embed/core/thread_model_patch.js b/addons/im_livechat/static/src/embed/core/thread_model_patch.js
index 6aa726ed367..de9955886ec 100644
--- a/addons/im_livechat/static/src/embed/core/thread_model_patch.js
+++ b/addons/im_livechat/static/src/embed/core/thread_model_patch.js
@@ -16,15 +16,22 @@ patch(Thread, {
         const chatbotService = this.env.services["im_livechat.chatbot"];
         const messageService = this.env.services["mail.message"];
         if (thread.type === "livechat" && isUnknown) {
-            onChange(thread, ["state", "seen_message_id", "message_unread_counter"], () => {
-                if (![SESSION_STATE.CLOSED, SESSION_STATE.NONE].includes(livechatService.state)) {
-                    livechatService.updateSession({
-                        state: thread.state,
-                        seen_message_id: thread.seen_message_id,
-                        channel: thread.channel,
-                    });
+            onChange(
+                thread,
+                ["state", "seen_message_id", "message_unread_counter", "allow_public_upload"],
+                () => {
+                    if (
+                        ![SESSION_STATE.CLOSED, SESSION_STATE.NONE].includes(livechatService.state)
+                    ) {
+                        livechatService.updateSession({
+                            state: thread.state,
+                            seen_message_id: thread.seen_message_id,
+                            channel: thread.channel,
+                            allow_public_upload: thread.allow_public_upload,
+                        });
+                    }
                 }
-            });
+            );
             if (chatbotService.isChatbotThread(thread)) {
                 thread.chatbotTypingMessage = {
                     id: messageService.getNextTemporaryId(),
diff --git a/addons/im_livechat/static/src/embed/cors/attachment_model_patch.js b/addons/im_livechat/static/src/embed/cors/attachment_model_patch.js
new file mode 100644
index 00000000000..d95f393e2a9
--- /dev/null
+++ b/addons/im_livechat/static/src/embed/cors/attachment_model_patch.js
@@ -0,0 +1,21 @@
+/* @odoo-module */
+
+import { Attachment } from "@mail/core/common/attachment_model";
+import { patch } from "@web/core/utils/patch";
+
+patch(Attachment.prototype, {
+    get urlQueryParams() {
+        return {
+            ...super.urlQueryParams,
+            guest_token: this._store.env.services["im_livechat.livechat"].guestToken,
+        };
+    },
+    get urlRoute() {
+        if (!this.accessToken && this.originThread?.model === "discuss.channel") {
+            return this.isImage
+                ? `/im_livechat/cors/channel/${this.originThread.id}/image/${this.id}`
+                : `/im_livechat/cors/channel/${this.originThread.id}/attachment/${this.id}`;
+        }
+        return super.urlRoute;
+    },
+});
diff --git a/addons/im_livechat/static/src/embed/cors/attachment_upload_service_patch.js b/addons/im_livechat/static/src/embed/cors/attachment_upload_service_patch.js
new file mode 100644
index 00000000000..0edb8f451f6
--- /dev/null
+++ b/addons/im_livechat/static/src/embed/cors/attachment_upload_service_patch.js
@@ -0,0 +1,17 @@
+/* @odoo-module */
+
+import { AttachmentUploadService } from "@mail/core/common/attachment_upload_service";
+
+import { patch } from "@web/core/utils/patch";
+import { session } from "@web/session";
+
+patch(AttachmentUploadService.prototype, {
+    get uploadURL() {
+        return `${session.origin}/im_livechat/cors/attachment/upload`;
+    },
+
+    _makeFormData() {
+        const formData = super._makeFormData(...arguments);
+        formData.append("guest_token", this.env.services["im_livechat.livechat"].guestToken);
+    },
+});
diff --git a/addons/im_livechat/static/src/embed/cors/livechat_routing_map.js b/addons/im_livechat/static/src/embed/cors/livechat_routing_map.js
index 36bb0965e21..609e22ebac8 100644
--- a/addons/im_livechat/static/src/embed/cors/livechat_routing_map.js
+++ b/addons/im_livechat/static/src/embed/cors/livechat_routing_map.js
@@ -18,6 +18,7 @@ livechatRoutingMap
         "/discuss/channel/set_last_seen_message",
         "/im_livechat/cors/channel/set_last_seen_message"
     )
+    .add("/mail/attachment/delete", "/im_livechat/cors/attachment/delete")
     .add("/discuss/channel/ping", "/im_livechat/cors/channel/ping")
     .add("/mail/init_messaging", "/im_livechat/cors/init_messaging")
     .add("/mail/link_preview", "/im_livechat/cors/link_preview")
diff --git a/addons/im_livechat/static/tests/composer_patch_tests.js b/addons/im_livechat/static/tests/composer_patch_tests.js
index e71e0ada0a5..e73b614a8e3 100644
--- a/addons/im_livechat/static/tests/composer_patch_tests.js
+++ b/addons/im_livechat/static/tests/composer_patch_tests.js
@@ -5,43 +5,10 @@ import { startServer } from "@bus/../tests/helpers/mock_python_environment";
 import { Command } from "@mail/../tests/helpers/command";
 import { start } from "@mail/../tests/helpers/test_utils";
 
-import { click, contains, createFile, dragenterFiles, insertText } from "@web/../tests/utils";
+import { click, contains, insertText } from "@web/../tests/utils";
 
 QUnit.module("composer (patch)");
 
-QUnit.test("No add attachments button", async () => {
-    const pyEnv = await startServer();
-    const channelId = pyEnv["discuss.channel"].create({
-        name: "Livechat 1",
-        channel_type: "livechat",
-    });
-    const { openDiscuss } = await start();
-    await openDiscuss(channelId);
-    await contains(".o-mail-Composer");
-    await contains("button[title='Attach files']", { count: 0 });
-});
-
-QUnit.test("Attachment upload via drag and drop disabled", async () => {
-    const pyEnv = await startServer();
-    const channelId = pyEnv["discuss.channel"].create({
-        name: "Livechat 1",
-        channel_type: "livechat",
-    });
-    const { openDiscuss } = await start();
-    await openDiscuss(channelId);
-    await contains(".o-mail-Composer");
-    const files = [
-        await createFile({
-            content: "hello, world",
-            contentType: "text/plain",
-            name: "text3.txt",
-        }),
-    ];
-    await dragenterFiles(".o-mail-Composer-input", files);
-    // weak test: no guarantee that we waited long enough for the potential dropzone to show
-    await contains(".o-mail-Dropzone", { count: 0 });
-});
-
 QUnit.test("Can execute help command on livechat channels", async (assert) => {
     const pyEnv = await startServer();
     const guestId = pyEnv["mail.guest"].create({ name: "Visitor 11" });
diff --git a/addons/im_livechat/tests/__init__.py b/addons/im_livechat/tests/__init__.py
index f3339ab66b0..4f6047dc3f1 100644
--- a/addons/im_livechat/tests/__init__.py
+++ b/addons/im_livechat/tests/__init__.py
@@ -12,3 +12,4 @@ from . import test_im_livechat_report
 from . import test_im_livechat_support_page
 from . import test_js
 from . import test_message
+from . import test_upload_attachment
diff --git a/addons/im_livechat/tests/test_upload_attachment.py b/addons/im_livechat/tests/test_upload_attachment.py
new file mode 100644
index 00000000000..073aef87875
--- /dev/null
+++ b/addons/im_livechat/tests/test_upload_attachment.py
@@ -0,0 +1,36 @@
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo import http
+from odoo.tests.common import tagged, HttpCase
+from odoo.tools import mute_logger, file_open
+
+
+@tagged("post_install", "-at_install")
+class TestUploadAttachment(HttpCase):
+    def test_visitor_cannot_upload_on_closed_livechat(self):
+        self.authenticate(None, None)
+        operator = self.env["res.users"].create({"name": "Operator", "login": "operator"})
+        self.env["bus.presence"].create({"user_id": operator.id, "status": "online"})
+        livechat_channel = self.env["im_livechat.channel"].create(
+            {"name": "Test Livechat Channel", "user_ids": [operator.id]}
+        )
+        channel_info = self.make_jsonrpc_request(
+            "/im_livechat/get_session",
+            {
+                "anonymous_name": "Visitor",
+                "channel_id": livechat_channel.id,
+                "persisted": True,
+            },
+        )
+        self.make_jsonrpc_request("/im_livechat/visitor_leave_session", {"uuid": channel_info["uuid"]})
+        with mute_logger("odoo.http"), file_open("addons/web/__init__.py") as file:
+            response = self.url_open(
+                "/mail/attachment/upload",
+                {
+                    "csrf_token": http.Request.csrf_token(self),
+                    "thread_id": channel_info["id"],
+                    "thread_model": "discuss.channel",
+                },
+                files={"ufile": file},
+            )
+            self.assertEqual(response.status_code, 403)
diff --git a/addons/im_livechat/views/im_livechat_channel_templates.xml b/addons/im_livechat/views/im_livechat_channel_templates.xml
index ece093833eb..cc1a2c4da3f 100644
--- a/addons/im_livechat/views/im_livechat_channel_templates.xml
+++ b/addons/im_livechat/views/im_livechat_channel_templates.xml
@@ -89,7 +89,9 @@
         <template id="loader" name="Livechat : Javascript appending the livechat button">
             <t t-translation="off">
                 if (!window.odoo) {
-                    window.odoo = {};
+                    window.odoo = {
+                        csrf_token: "<t t-out="request.csrf_token(None)"/>",
+                    };
                 }
                 odoo.__session_info__ = Object.assign(odoo.__session_info__ || {}, {
                     livechatData: {
diff --git a/addons/mail/controllers/attachment.py b/addons/mail/controllers/attachment.py
index 1931184362e..6d0df411bfe 100644
--- a/addons/mail/controllers/attachment.py
+++ b/addons/mail/controllers/attachment.py
@@ -47,7 +47,9 @@ class AttachmentController(http.Controller):
     @http.route("/mail/attachment/upload", methods=["POST"], type="http", auth="public")
     @add_guest_to_context
     def mail_attachment_upload(self, ufile, thread_id, thread_model, is_pending=False, **kwargs):
-        env = request.env["ir.attachment"]._get_upload_env(thread_model, thread_id)
+        thread = request.env[thread_model]._get_from_context_or_raise(int(thread_id))
+        if thread_model == "discuss.channel" and not thread.allow_public_upload and not request.env.user._is_internal():
+            raise AccessError(_("You are not allowed to upload attachments on this channel."))
         vals = {
             "name": ufile.filename,
             "raw": ufile.read(),
@@ -63,11 +65,11 @@ class AttachmentController(http.Controller):
                     "res_model": "mail.compose.message",
                 }
             )
-        if env.user.share:
+        if thread.env.user.share:
             # Only generate the access token if absolutely necessary (= not for internal user).
-            vals["access_token"] = env["ir.attachment"]._generate_access_token()
+            vals["access_token"] = thread.env["ir.attachment"]._generate_access_token()
         try:
-            attachment = env["ir.attachment"].create(vals)
+            attachment = thread.env["ir.attachment"].create(vals)
             attachment._post_add_create(**kwargs)
             attachmentData = attachment._attachment_format()[0]
             if attachment.access_token:
diff --git a/addons/mail/models/discuss/discuss_channel.py b/addons/mail/models/discuss/discuss_channel.py
index 56d3a25fa43..cdcfbedf96c 100644
--- a/addons/mail/models/discuss/discuss_channel.py
+++ b/addons/mail/models/discuss/discuss_channel.py
@@ -81,6 +81,7 @@ class Channel(models.Model):
     uuid = fields.Char('UUID', size=50, default=_generate_random_token, copy=False)
     group_public_id = fields.Many2one('res.groups', string='Authorized Group', compute='_compute_group_public_id', readonly=False, store=True)
     invitation_url = fields.Char('Invitation URL', compute='_compute_invitation_url')
+    allow_public_upload = fields.Boolean(default=False)
 
     _sql_constraints = [
         ('channel_type_not_null', 'CHECK(channel_type IS NOT NULL)', 'The channel type cannot be empty'),
@@ -860,6 +861,7 @@ class Channel(models.Model):
                 'group_based_subscription': bool(channel.group_ids),
                 'create_uid': channel.create_uid.id,
                 'authorizedGroupFullName': channel.group_public_id.full_name,
+                'allow_public_upload': channel.allow_public_upload,
             }
             # add last message preview (only used in mobile)
             info['last_message_id'] = channel_last_message_ids.get(channel.id, False)
diff --git a/addons/mail/models/discuss/ir_attachment.py b/addons/mail/models/discuss/ir_attachment.py
index b501ae2f199..0c062e232a9 100644
--- a/addons/mail/models/discuss/ir_attachment.py
+++ b/addons/mail/models/discuss/ir_attachment.py
@@ -1,6 +1,6 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-from odoo import api, models, fields
+from odoo import models, fields
 
 
 class IrAttachment(models.Model):
@@ -17,19 +17,6 @@ class IrAttachment(models.Model):
             return guest
         return super()._bus_notification_target()
 
-    @api.model
-    def _get_upload_env(self, thread_model, thread_id):
-        """Overriden to allow guests and (portal) users to upload attachments to channels they have
-        access to. The base method returns the env of the current request, which is not sudo and
-        relies on access rights. Guests or (portal) users need sudo to upload attachments."""
-        if thread_model == "discuss.channel":
-            return (
-                self.env["discuss.channel.member"]
-                ._get_as_sudo_from_context_or_raise(channel_id=int(thread_id))
-                .env
-            )
-        return super()._get_upload_env(thread_model, thread_id)
-
     def _attachment_format(self):
         attachment_format = super()._attachment_format()
         for a in attachment_format:
diff --git a/addons/mail/models/ir_attachment.py b/addons/mail/models/ir_attachment.py
index 297bd6ea63e..2f64600d903 100644
--- a/addons/mail/models/ir_attachment.py
+++ b/addons/mail/models/ir_attachment.py
@@ -88,7 +88,3 @@ class IrAttachment(models.Model):
                 'model': attachment.res_model,
             })],
         } for attachment in self]
-
-    @api.model
-    def _get_upload_env(self, thread_model, thread_id):
-        return request.env
diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py
index 6f2ca58a5d4..3b010f37333 100644
--- a/addons/mail/models/mail_thread.py
+++ b/addons/mail/models/mail_thread.py
@@ -22,6 +22,7 @@ from email.message import EmailMessage
 from email import message_from_string
 from lxml import etree
 from werkzeug import urls
+from werkzeug.exceptions import NotFound
 from xmlrpc import client as xmlrpclib
 from markupsafe import Markup, escape
 
@@ -480,7 +481,10 @@ class MailThread(models.AbstractModel):
 
     @api.model
     def _get_from_context_or_raise(self, thread_id):
-        return self.browse(thread_id).exists()
+        thread = self.search([["id", "=", thread_id]])
+        if not thread:
+            raise NotFound()
+        return thread
 
     # ------------------------------------------------------
     # TRACKING / LOG
diff --git a/addons/mail/static/src/core/common/attachment_upload_service.js b/addons/mail/static/src/core/common/attachment_upload_service.js
index 4fb09eec865..74f800cc4f2 100644
--- a/addons/mail/static/src/core/common/attachment_upload_service.js
+++ b/addons/mail/static/src/core/common/attachment_upload_service.js
@@ -121,6 +121,10 @@ export class AttachmentUploadService {
         );
     }
 
+    get uploadURL() {
+        return "/mail/attachment/upload";
+    }
+
     async unlink(attachment) {
         const abort = this.abortByAttachmentId.get(attachment.id);
         const def = this.deferredByAttachmentId.get(attachment.id);
@@ -138,7 +142,7 @@ export class AttachmentUploadService {
         this.hookersByTmpId.set(tmpId, hooker);
         this.uploadingAttachmentIds.add(tmpId);
         await this.fileUploadService
-            .upload("/mail/attachment/upload", [file], {
+            .upload(this.uploadURL, [file], {
                 buildFormData: (formData) => {
                     this._makeFormData(formData, file, hooker, tmpId, options);
                 },
diff --git a/addons/mail/static/src/core/common/composer.js b/addons/mail/static/src/core/common/composer.js
index b5e58f80594..2344c752bd4 100644
--- a/addons/mail/static/src/core/common/composer.js
+++ b/addons/mail/static/src/core/common/composer.js
@@ -81,12 +81,10 @@ export class Composer extends Component {
             _t("<samp>%(send_keybind)s</samp><i> to send</i>", { send_keybind: this.sendKeybind })
         );
         this.store = useState(useService("mail.store"));
-        if (this.allowUpload) {
-            this.attachmentUploader = useAttachmentUploader(
-                this.thread ?? this.props.composer.message.originThread,
-                { composer: this.props.composer }
-            );
-        }
+        this.attachmentUploader = useAttachmentUploader(
+            this.thread ?? this.props.composer.message.originThread,
+            { composer: this.props.composer }
+        );
         this.messageService = useState(useService("mail.message"));
         this.threadService = useService("mail.thread");
         this.ui = useState(useService("ui"));
@@ -117,8 +115,13 @@ export class Composer extends Component {
         this.suggestion = this.store.user ? useSuggestion() : undefined;
         this.markEventHandled = markEventHandled;
         this.onDropFile = this.onDropFile.bind(this);
-        if (this.props.dropzoneRef && this.allowUpload) {
-            useDropzone(this.props.dropzoneRef, this.onDropFile, "o-mail-Composer-dropzone");
+        if (this.props.dropzoneRef) {
+            useDropzone(
+                this.props.dropzoneRef,
+                this.onDropFile,
+                "o-mail-Composer-dropzone",
+                () => this.allowUpload
+            );
         }
         if (this.props.messageEdition) {
             this.props.messageEdition.composerOfThread = this;
diff --git a/addons/mail/static/src/core/common/dropzone_hook.js b/addons/mail/static/src/core/common/dropzone_hook.js
index 6fe0ed2d246..09bbec27425 100644
--- a/addons/mail/static/src/core/common/dropzone_hook.js
+++ b/addons/mail/static/src/core/common/dropzone_hook.js
@@ -9,7 +9,7 @@ import { registry } from "@web/core/registry";
 const componentRegistry = registry.category("main_components");
 
 let id = 1;
-export function useDropzone(targetRef, onDrop, extraClass) {
+export function useDropzone(targetRef, onDrop, extraClass, isDropzoneEnabled = () => true) {
     const dropzoneId = `mail.dropzone_${id++}`;
     let dragCount = 0;
     let hasTarget = false;
@@ -26,7 +26,7 @@ export function useDropzone(targetRef, onDrop, extraClass) {
     });
 
     function updateDropzone() {
-        const shouldDisplayDropzone = dragCount && hasTarget;
+        const shouldDisplayDropzone = dragCount && hasTarget && isDropzoneEnabled();
         const hasDropzone = componentRegistry.contains(dropzoneId);
         if (shouldDisplayDropzone && !hasDropzone) {
             componentRegistry.add(dropzoneId, {
diff --git a/addons/mail/static/src/discuss/core/common/attachment_panel.js b/addons/mail/static/src/discuss/core/common/attachment_panel.js
index 77ecbeb2b3e..cdc8f877afc 100644
--- a/addons/mail/static/src/discuss/core/common/attachment_panel.js
+++ b/addons/mail/static/src/discuss/core/common/attachment_panel.js
@@ -6,7 +6,7 @@ import { AttachmentList } from "@mail/core/common/attachment_list";
 
 import { Component, onWillStart, onWillUpdateProps } from "@odoo/owl";
 import { useService } from "@web/core/utils/hooks";
-import { useVisible } from "@mail/utils/common/hooks";
+import { useSequential, useVisible } from "@mail/utils/common/hooks";
 
 /**
  * @typedef {Object} Props
@@ -18,6 +18,9 @@ export class AttachmentPanel extends Component {
     static template = "mail.AttachmentPanel";
 
     setup() {
+        this.sequential = useSequential();
+        this.store = useService("mail.store");
+        this.ormService = useService("orm");
         this.threadService = useService("mail.thread");
         this.attachmentUploadService = useService("mail.attachment_upload");
         onWillStart(() => {
@@ -47,4 +50,20 @@ export class AttachmentPanel extends Component {
         }
         return attachmentsByDate;
     }
+
+    get hasToggleAllowPublicUpload() {
+        return (
+            this.props.thread.model !== "mail.box" &&
+            this.props.thread.type !== "chat" &&
+            this.store.user?.user?.isInternalUser
+        );
+    }
+
+    toggleAllowPublicUpload() {
+        this.sequential(() =>
+            this.ormService.write("discuss.channel", [this.props.thread.id], {
+                allow_public_upload: !this.props.thread.allow_public_upload,
+            })
+        );
+    }
 }
diff --git a/addons/mail/static/src/discuss/core/common/attachment_panel.xml b/addons/mail/static/src/discuss/core/common/attachment_panel.xml
index e71f58ddaee..1310eaa4c86 100644
--- a/addons/mail/static/src/discuss/core/common/attachment_panel.xml
+++ b/addons/mail/static/src/discuss/core/common/attachment_panel.xml
@@ -4,6 +4,13 @@
     <t t-name="mail.AttachmentPanel">
         <t t-set="title">Attachments</t>
         <ActionPanel title="title">
+            <div t-if="hasToggleAllowPublicUpload" class="form-check form-switch">
+                <label class="form-check-label">
+                    <input t-on-change="toggleAllowPublicUpload" class="form-check-input" type="checkbox" role="switch" t-att-checked="props.thread.allow_public_upload"/>
+                    <t t-if="props.thread.allow_public_upload">File upload is enabled for external users</t>
+                    <t t-else="">File upload is disabled for external users</t>
+                </label>
+            </div>
             <div class="flex-grow-1" t-att-class="{
                 'd-flex justify-content-center align-items-center': props.thread.attachments.length === 0,
             }">
diff --git a/addons/mail/static/src/discuss/core/common/attachment_upload_service_patch.js b/addons/mail/static/src/discuss/core/common/attachment_upload_service_patch.js
new file mode 100644
index 00000000000..1d44d947dcb
--- /dev/null
+++ b/addons/mail/static/src/discuss/core/common/attachment_upload_service_patch.js
@@ -0,0 +1,24 @@
+/* @odoo-module */
+
+import { AttachmentUploadService } from "@mail/core/common/attachment_upload_service";
+
+import { patch } from "@web/core/utils/patch";
+
+patch(AttachmentUploadService.prototype, {
+    setup() {
+        super.setup(...arguments);
+        this.env.services["bus_service"].subscribe("mail.record/insert", ({ Thread }) => {
+            if (
+                Thread &&
+                "allow_public_upload" in Thread &&
+                !Thread.allow_public_upload &&
+                !this.store.user?.user?.isInternalUser
+            ) {
+                const attachments = [...this.store.Thread.insert(Thread).composer.attachments];
+                for (const attachment of attachments) {
+                    this.unlink(attachment);
+                }
+            }
+        });
+    },
+});
diff --git a/addons/mail/static/src/discuss/core/common/composer_patch.js b/addons/mail/static/src/discuss/core/common/composer_patch.js
new file mode 100644
index 00000000000..47c08b75d22
--- /dev/null
+++ b/addons/mail/static/src/discuss/core/common/composer_patch.js
@@ -0,0 +1,16 @@
+/* @odoo-module */
+
+import { Composer } from "@mail/core/common/composer";
+import { patch } from "@web/core/utils/patch";
+
+patch(Composer.prototype, {
+    get allowUpload() {
+        const thread = this.thread ?? this.message.originThread;
+        return (
+            super.allowUpload &&
+            (thread.model !== "discuss.channel" ||
+                thread?.allow_public_upload ||
+                this.store.user?.user?.isInternalUser)
+        );
+    },
+});
diff --git a/addons/mail/static/src/discuss/core/common/thread_model_patch.js b/addons/mail/static/src/discuss/core/common/thread_model_patch.js
index 787642e52d4..54fcc690173 100644
--- a/addons/mail/static/src/discuss/core/common/thread_model_patch.js
+++ b/addons/mail/static/src/discuss/core/common/thread_model_patch.js
@@ -19,4 +19,8 @@ patch(Thread.prototype, {
         }
         return super.imgUrl;
     },
+    update(data) {
+        super.update(data);
+        assignDefined(this, data, ["allow_public_upload"]);
+    },
 });
diff --git a/addons/mail/static/tests/discuss/core/attachment_panel_tests.js b/addons/mail/static/tests/discuss/core/attachment_panel_tests.js
index 125e4a8479a..81075f4fd0f 100644
--- a/addons/mail/static/tests/discuss/core/attachment_panel_tests.js
+++ b/addons/mail/static/tests/discuss/core/attachment_panel_tests.js
@@ -49,3 +49,23 @@ QUnit.test("Attachment panel sort by date", async () => {
         after: [".o-mail-DateSection", { text: "August, 2023" }],
     });
 });
+
+QUnit.test("Can toggle allow public upload", async () => {
+    const pyEnv = await startServer();
+    const channelId = await pyEnv["discuss.channel"].create({ name: "General" });
+    const tab1 = await start({ asTab: true });
+    await tab1.openDiscuss(channelId);
+    await click(".o-mail-Discuss-header button[title='Show Attachments']", { target: tab1.target });
+    const tab2 = await start({ asTab: true });
+    await tab2.openDiscuss(channelId);
+    await click(".o-mail-Discuss-header button[title='Show Attachments']", { target: tab2.target });
+    await contains(".o-mail-ActionPanel", {
+        contains: ["label", { text: "File upload is disabled for external users" }],
+        target: tab2.target,
+    });
+    await click(".o-mail-ActionPanel input[type='checkbox']", { target: tab1.target });
+    await contains(".o-mail-ActionPanel", {
+        contains: ["label", { text: "File upload is enabled for external users" }],
+        target: tab2.target,
+    });
+});
diff --git a/addons/mail/static/tests/helpers/mock_server/models/discuss_channel.js b/addons/mail/static/tests/helpers/mock_server/models/discuss_channel.js
index 0bd45a82e19..c87dabb5f8d 100644
--- a/addons/mail/static/tests/helpers/mock_server/models/discuss_channel.js
+++ b/addons/mail/static/tests/helpers/mock_server/models/discuss_channel.js
@@ -735,6 +735,7 @@ patch(MockServer.prototype, {
                 ],
             ];
             res.channel = channelData;
+            res.allow_public_upload = channel.allow_public_upload;
             return res;
         });
     },
diff --git a/addons/mail/static/tests/helpers/mock_server/models/mail_message.js b/addons/mail/static/tests/helpers/mock_server/models/mail_message.js
index 2e9e32ce3cc..51c6793f653 100644
--- a/addons/mail/static/tests/helpers/mock_server/models/mail_message.js
+++ b/addons/mail/static/tests/helpers/mock_server/models/mail_message.js
@@ -220,7 +220,7 @@ patch(MockServer.prototype, {
                     type: "partner",
                 };
                 if (user) {
-                    author["user"] = { id: user.id };
+                    author["user"] = { id: user.id, isInternalUser: !user.share };
                 }
             } else {
                 author = false;
diff --git a/addons/mail/static/tests/helpers/mock_server/models/res_partner.js b/addons/mail/static/tests/helpers/mock_server/models/res_partner.js
index 00c248de19d..46846b43625 100644
--- a/addons/mail/static/tests/helpers/mock_server/models/res_partner.js
+++ b/addons/mail/static/tests/helpers/mock_server/models/res_partner.js
@@ -279,6 +279,7 @@ patch(MockServer.prototype, {
                         user: mainUser
                             ? {
                                   id: mainUser.id,
+                                  isInternalUser: !mainUser.share,
                               }
                             : false,
                     },
diff --git a/addons/mail/tests/discuss/__init__.py b/addons/mail/tests/discuss/__init__.py
index 4451a3547cb..8905d512b1b 100644
--- a/addons/mail/tests/discuss/__init__.py
+++ b/addons/mail/tests/discuss/__init__.py
@@ -4,5 +4,6 @@ from . import test_discuss_channel
 from . import test_discuss_channel_as_guest
 from . import test_discuss_channel_member
 from . import test_message_controller
+from . import test_toggle_upload
 from . import test_load_messages
 from . import test_rtc
diff --git a/addons/mail/tests/discuss/test_discuss_channel_as_guest.py b/addons/mail/tests/discuss/test_discuss_channel_as_guest.py
index ba94151747f..36473d248e6 100644
--- a/addons/mail/tests/discuss/test_discuss_channel_as_guest.py
+++ b/addons/mail/tests/discuss/test_discuss_channel_as_guest.py
@@ -29,12 +29,14 @@ class TestMailPublicPage(HttpCase):
         guest = self.env['mail.guest'].create({'name': 'Guest Mario'})
 
         self.channel = self.env['discuss.channel'].browse(self.env['discuss.channel'].channel_create(group_id=None, name='Test channel')['id'])
+        self.channel.allow_public_upload = True
         self.channel.add_members(portal_user.partner_id.ids)
         self.channel.add_members(internal_user.partner_id.ids)
         self.channel.add_members(guest_ids=[guest.id])
 
         self.group = self.env['discuss.channel'].browse(self.env['discuss.channel'].create_group(partners_to=(internal_user + portal_user).partner_id.ids, name="Test group")['id'])
         self.group.add_members(guest_ids=[guest.id])
+        self.group.allow_public_upload = True
 
         self.tour = "mail/static/tests/tours/discuss_public_tour.js"
 
diff --git a/addons/mail/tests/discuss/test_toggle_upload.py b/addons/mail/tests/discuss/test_toggle_upload.py
new file mode 100644
index 00000000000..15af69ce3b2
--- /dev/null
+++ b/addons/mail/tests/discuss/test_toggle_upload.py
@@ -0,0 +1,51 @@
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from requests.exceptions import HTTPError
+
+from odoo import Command, http
+from odoo.tests import tagged, HttpCase
+from odoo.tools import file_open, mute_logger
+
+
+@tagged("post_install", "-at_install")
+class TestToggleUpload(HttpCase):
+    def test_upload_allowed(self):
+        self.authenticate(None, None)
+        channel = self.env["discuss.channel"].create({"name": "General"})
+        guest = self.env["mail.guest"].create({"name": "Guest"})
+        channel.write({"channel_member_ids": [Command.create({"guest_id": guest.id})]})
+        self.assertFalse(channel.allow_public_upload)
+        channel.write({'allow_public_upload': True})
+        with file_open("addons/web/__init__.py") as file:
+            response = self.url_open(
+                "/mail/attachment/upload",
+                {
+                    "csrf_token": http.Request.csrf_token(self),
+                    "thread_id": channel.id,
+                    "thread_model": "discuss.channel",
+                },
+                files={"ufile": file},
+                headers={"Cookie": f"session_id={self.session.sid};{guest._cookie_name}={guest._format_auth_cookie()};"},
+            )
+        self.assertEqual(response.status_code, 200)
+
+    def test_upload_denied(self):
+        self.authenticate(None, None)
+        channel = self.env["discuss.channel"].create({"name": "General"})
+        guest = self.env["mail.guest"].create({"name": "Guest"})
+        channel.write({"channel_member_ids": [Command.create({"guest_id": guest.id})]})
+        self.assertFalse(channel.allow_public_upload)
+        with mute_logger("odoo.http"), file_open("addons/web/__init__.py") as file:
+            response = self.url_open(
+                "/mail/attachment/upload",
+                {
+                    "csrf_token": http.Request.csrf_token(self),
+                    "thread_id": channel.id,
+                    "thread_model": "discuss.channel",
+                },
+                files={"ufile": file},
+                headers={"Cookie": f"session_id={self.session.sid};{guest._cookie_name}={guest._format_auth_cookie()};"},
+            )
+        with self.assertRaises(HTTPError) as error_catcher:
+            response.raise_for_status()
+        self.assertEqual(error_catcher.exception.response.status_code, 403)
diff --git a/addons/test_discuss_full/tests/test_performance.py b/addons/test_discuss_full/tests/test_performance.py
index df04431fb03..87c244d8073 100644
--- a/addons/test_discuss_full/tests/test_performance.py
+++ b/addons/test_discuss_full/tests/test_performance.py
@@ -131,6 +131,7 @@ class TestDiscussFullPerformance(HttpCase):
             'odoobotOnboarding': False,
             'channels': [
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': self.group_user.full_name,
                     'channel': {
                         'anonymous_country': False,
@@ -181,6 +182,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_general.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': False,
@@ -231,6 +233,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_channel_public_1.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': False,
@@ -281,6 +284,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_channel_public_2.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': self.group_user.full_name,
                     'channel': {
                         'anonymous_country': False,
@@ -331,6 +335,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_channel_group_1.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': self.group_user.full_name,
                     'channel': {
                         'anonymous_country': False,
@@ -381,6 +386,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_channel_group_2.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': False,
@@ -467,6 +473,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_group_1.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': False,
@@ -553,6 +560,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_chat_1.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': False,
@@ -639,6 +647,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_chat_2.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': False,
@@ -725,6 +734,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_chat_3.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': False,
@@ -811,6 +821,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_chat_4.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': {
@@ -896,6 +907,7 @@ class TestDiscussFullPerformance(HttpCase):
                     'uuid': self.channel_livechat_1.uuid,
                 },
                 {
+                    'allow_public_upload': False,
                     'authorizedGroupFullName': False,
                     'channel': {
                         'anonymous_country': {
diff --git a/addons/web/static/src/views/fields/file_handler.js b/addons/web/static/src/views/fields/file_handler.js
index 5f5ba84bb75..accda9956e6 100644
--- a/addons/web/static/src/views/fields/file_handler.js
+++ b/addons/web/static/src/views/fields/file_handler.js
@@ -23,6 +23,7 @@ export class FileUploader extends Component {
         if (!ev.target.files.length) {
             return;
         }
+        const { target } = ev;
         for (const file of ev.target.files) {
             if (!checkFileSize(file.size, this.notification)) {
                 return null;
@@ -47,7 +48,7 @@ export class FileUploader extends Component {
                 this.state.isUploading = false;
             }
         }
-        ev.target.value = null;
+        target.value = null;
         if (this.props.multiUpload && this.props.onUploadComplete) {
             this.props.onUploadComplete({});
         }