svs-odoo
c1f3596bd3
How to reproduce:
- Open PLM app, open an Engineering Change Order;
- Click on "Update Documents";
- Try to upload a document -> Traceback.
As we did not cast res_id as integer, the check method of ir.attachment
crashes when accessing company_id on a malformed recordset of ECO
because the domain generated by _filter_access_rules_python is:
`['|', ('company_id', '=', False), ('company_id', 'in', [2, 1])]`
This route is also used when adding attachment to a `product.product`.
In this case the check didn't work either but somehow passed because no
domain is generated by `_filter_access_rules_python`.
The following snippet shows that if there was one, it would also crash:
```
In [16]: records
Out[16]: product.product('25',)
In [17]: records.stock_move_ids
Out[17]: stock.move()
In [18]: self.env['product.product'].browse(25)
Out[18]: product.product(25,)
In [19]: self.env['product.product'].browse(25).stock_move_ids
Out[19]: stock.move(41, 13)
```
task-2223153
closes odoo/odoo#48515
Signed-off-by: Simon Lejeune (sle) <sle@openerp.com>
37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
import base64
|
|
import json
|
|
import logging
|
|
|
|
from odoo import http
|
|
from odoo.http import request
|
|
from odoo.tools.mimetypes import neuter_mimetype
|
|
from odoo.tools.translate import _
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class MrpDocumentRoute(http.Controller):
|
|
|
|
@http.route('/mrp/upload_attachment', type='http', methods=['POST'], auth="user")
|
|
def upload_document(self, ufile, **kwargs):
|
|
files = request.httprequest.files.getlist('ufile')
|
|
result = {'success': _("All files uploaded")}
|
|
for ufile in files:
|
|
try:
|
|
mimetype = neuter_mimetype(ufile.content_type, http.request.env.user)
|
|
request.env['mrp.document'].create({
|
|
'name': ufile.filename,
|
|
'res_model': kwargs.get('res_model'),
|
|
'res_id': int(kwargs.get('res_id')),
|
|
'mimetype': mimetype,
|
|
'datas': base64.encodebytes(ufile.read()),
|
|
})
|
|
except Exception as e:
|
|
logger.exception("Fail to upload document %s" % ufile.filename)
|
|
result = {'error': str(e)}
|
|
|
|
return json.dumps(result)
|