Merge lp:~therp-nl/ocb-server/6.1-attachment_search_invalid_model into lp:ocb-server/6.1

[Stefan Rijnhart (Opener)]

Fix problems with accessing attachments with missing models or record ids. Backports of

https://github.com/odoo/odoo/commit/eb9113c04d66627fbe04b473b9010e5de973c6aa
https://github.com/odoo/odoo/commit/4669f05406b07074c38b4d19c0c2ddf4e9407918

[Pedro Manuel Baeza (pedro.baeza)]

LGTM

review: Approve

[lp:~therp-nl/ocb-server/6.1-attachment_search_invalid_model]

4331. By OpenERP instance user <email address hidden> on 2015-02-19

[FIX] Can't do that in 6.1 yet

Unmerged revisions

4331. By OpenERP instance user <email address hidden> on 2015-02-19

[FIX] Can't do that in 6.1 yet

4330. By Denis Ledoux (OpenERP) on 2015-02-18

[FIX] ir_attachment: restrict access to orphan attachments to employees
and fix crashes when retrieving attachments without existing models or
records

4329. By Denis Ledoux (OpenERP) on 2015-02-18

[FIX] Don't break attachment search on attachments of models that are removed

=== modified file 'openerp/addons/base/ir/ir_attachment.py'
--- openerp/addons/base/ir/ir_attachment.py	2013-09-10 14:15:41 +0000
+++ openerp/addons/base/ir/ir_attachment.py	2015-02-19 09:01:07 +0000
@@ -23,6 +23,7 @@
 
 from osv import fields,osv
 from osv.orm import except_orm
+from openerp.tools.translate import _
 import tools
 
 class ir_attachment(osv.osv):
@@ -34,12 +35,14 @@
         if not ids:
             return
         res_ids = {}
+        require_employee = False
         if ids:
             if isinstance(ids, (int, long)):
                 ids = [ids]
             cr.execute('SELECT DISTINCT res_model, res_id FROM ir_attachment WHERE id = ANY (%s)', (ids,))
             for rmod, rid in cr.fetchall():
                 if not (rmod and rid):
+                    require_employee = True
                     continue
                 res_ids.setdefault(rmod,set()).add(rid)
         if values:
@@ -50,9 +53,17 @@
         for model, mids in res_ids.items():
             # ignore attachments that are not attached to a resource anymore when checking access rights
             # (resource was deleted but attachment was not)
-            mids = self.pool.get(model).exists(cr, uid, mids)
+            if not self.pool.get(model):
+                require_employee = True
+                continue
+            existing_ids = self.pool.get(model).exists(cr, uid, mids)
+            if len(existing_ids) != len(mids):
+                require_employee = True
             ima.check(cr, uid, model, mode)
-            self.pool.get(model).check_access_rule(cr, uid, mids, mode, context=context)
+            self.pool.get(model).check_access_rule(cr, uid, existing_ids, mode, context=context)
+        if require_employee:
+            if not self.pool['ir.model.access'].check_groups(cr, uid, 'base.group_user'):
+                raise except_orm(_('Access Denied'), _("Sorry, you are not allowed to access this document."))
 
     def _search(self, cr, uid, args, offset=0, limit=None, order=None, context=None, count=False, access_rights_uid=None):
         ids = super(ir_attachment, self)._search(cr, uid, args, offset=offset,
@@ -87,6 +98,8 @@
         # performed in batch as much as possible.
         ima = self.pool.get('ir.model.access')
         for model, targets in model_attachments.iteritems():
+            if not self.pool.get(model):
+                continue        
             if not ima.check(cr, uid, model, 'read', False):
                 # remove all corresponding attachment ids
                 for attach_id in itertools.chain(*targets.values()):