Laurent Smet
65af112e2b
An attachment has complex access rights. If there is no res_model/res_id, the access rights are admin (not exactly but let's say that).
When an EDI like Facturx/E-FFF generates an attachment not linked to any model, you don't have access to it except if you are admin.
However, here we have a security issue since everyone is able to write any 'id' on the 'attachment_id' field.
If you do that using Facturx, knowing this EDI will embed its attachment inside the invoice PDF report in sudo mode, you have now a way to extract any attachment from the database including the ones you shouldn't have access to.
Furthermore, a different api introduced by OWL makes the form view of account.edi.document popping from the one2many inside the invoice form.
Instead of "options={'no_open': '1'}", the new api is now to put directly "no_open='1'" on the root node.
If you combine both issues above, you currently have a way to extract any 'attachment_id' from the database and odoo is kind enough to give you the form view to do it.
closes odoo/odoo#111210
Solution: "account.edi.document.attachment_id" is now accessible to the admin only.
X-original-commit: 44a4cdb3944a4b722dcfbca5e2947a4372b8501d
Signed-off-by: Olivier Colson (oco) <oco@odoo.com>
48 lines
2.1 KiB
Python
48 lines
2.1 KiB
Python
# -*- coding: utf-8 -*-
|
|
|
|
import io
|
|
|
|
from odoo import models
|
|
from odoo.tools.pdf import OdooPdfFileReader, OdooPdfFileWriter
|
|
|
|
|
|
class IrActionsReport(models.Model):
|
|
_inherit = 'ir.actions.report'
|
|
|
|
def _render_qweb_pdf_prepare_streams(self, report_ref, data, res_ids=None):
|
|
# EXTENDS base
|
|
collected_streams = super()._render_qweb_pdf_prepare_streams(report_ref, data, res_ids=res_ids)
|
|
|
|
if collected_streams \
|
|
and res_ids \
|
|
and len(res_ids) == 1 \
|
|
and self._get_report(report_ref).report_name in ('account.report_invoice_with_payments', 'account.report_invoice'):
|
|
invoice = self.env['account.move'].browse(res_ids)
|
|
if invoice.is_sale_document() and invoice.state != 'draft':
|
|
to_embed = invoice.edi_document_ids
|
|
# Add the attachments to the pdf file
|
|
if to_embed:
|
|
pdf_stream = collected_streams[invoice.id]['stream']
|
|
|
|
# Read pdf content.
|
|
pdf_content = pdf_stream.getvalue()
|
|
reader_buffer = io.BytesIO(pdf_content)
|
|
reader = OdooPdfFileReader(reader_buffer, strict=False)
|
|
|
|
# Post-process and embed the additional files.
|
|
writer = OdooPdfFileWriter()
|
|
writer.cloneReaderDocumentRoot(reader)
|
|
for edi_document in to_embed:
|
|
# The attachements on the edi documents are only system readable
|
|
# because they don't have res_id and res_model, here we are sure that
|
|
# the user has access to the invoice and edi document
|
|
edi_document.edi_format_id._prepare_invoice_report(writer, edi_document)
|
|
|
|
# Replace the current content.
|
|
pdf_stream.close()
|
|
new_pdf_stream = io.BytesIO()
|
|
writer.write(new_pdf_stream)
|
|
collected_streams[invoice.id]['stream'] = new_pdf_stream
|
|
|
|
return collected_streams
|