Merge PR #420 into 18.0

Signed-off-by lmignon

.oca/oca-port/blacklist/fs_attachment.json

@@ -0,0 +1,5 @@
+{
+  "pull_requests": {
+    "OCA/storage#344": "migration PR"
+  }
+}

fs_attachment/fs_stream.py

@@ -38,7 +38,13 @@ def read(self):
                 return f.read()
         return super().read()
 
-    def get_response(self, as_attachment=None, immutable=None, **send_file_kwargs):
+    def get_response(
+        self,
+        as_attachment=None,
+        immutable=None,
+        content_security_policy="default-src 'none'",
+        **send_file_kwargs,
+    ):
         if self.type != "fs":
             return super().get_response(
                 as_attachment=as_attachment, immutable=immutable, **send_file_kwargs
@@ -57,7 +63,6 @@ def get_response(self, as_attachment=None, immutable=None, **send_file_kwargs):
             "max_age": STATIC_CACHE_LONG if immutable else self.max_age,
             "environ": request.httprequest.environ,
             "response_class": Response,
-            **send_file_kwargs,
         }
         use_x_sendfile = self._fs_use_x_sendfile
         # The file will be closed by werkzeug...
@@ -79,6 +84,12 @@ def get_response(self, as_attachment=None, immutable=None, **send_file_kwargs):
 
         if immutable and res.cache_control:
             res.cache_control["immutable"] = None
+
+        res.headers["X-Content-Type-Options"] = "nosniff"
+
+        if content_security_policy:
+            res.headers["Content-Security-Policy"] = content_security_policy
+
         return res
 
     @classmethod

fs_attachment/models/ir_binary.py

@@ -16,16 +16,14 @@
 class IrBinary(models.AbstractModel):
     _inherit = "ir.binary"
 
-    def _record_to_stream(self, record, field_name):
-        # Extend base implementation to support attachment stored into a
-        # filesystem storage
-        fs_attachment = None
+    def _get_fs_attachment_for_field(self, record, field_name):
         if record._name == "ir.attachment" and record.fs_filename:
-            fs_attachment = record
+            return record
+
         record.check_field_access_rights("read", [field_name])
         field_def = record._fields[field_name]
-        if field_def.attachment and not field_def.compute and not field_def.related:
-            field_attachment = (
+        if field_def.attachment and field_def.store:
+            fs_attachment = (
                 self.env["ir.attachment"]
                 .sudo()
                 .search(
@@ -37,8 +35,14 @@ def _record_to_stream(self, record, field_name):
                     limit=1,
                 )
             )
-            if field_attachment.fs_filename:
-                fs_attachment = field_attachment
+            if fs_attachment and fs_attachment.fs_filename:
+                return fs_attachment
+        return None
+
+    def _record_to_stream(self, record, field_name):
+        # Extend base implementation to support attachment stored into a
+        # filesystem storage
+        fs_attachment = self._get_fs_attachment_for_field(record, field_name)
         if fs_attachment:
             return FsStream.from_fs_attachment(fs_attachment)
         return super()._record_to_stream(record, field_name)
@@ -100,6 +104,11 @@ def _get_image_stream_from(
                 if value:
                     record = value.attachment
                     field_name = "raw"
+            elif field_def.type in ("binary"):
+                fs_attachment = self._get_fs_attachment_for_field(record, field_name)
+                if fs_attachment:
+                    record = fs_attachment
+                    field_name = "raw"
         stream = super()._get_image_stream_from(
             record,
             field_name=field_name,

fs_attachment/readme/CONTRIBUTORS.md

@@ -1,13 +1,15 @@
-Thierry Ducrest \<<[email protected]>\> Guewen Baconnier
-\<<[email protected]>\> Julien Coux
-\<<[email protected]>\> Akim Juillerat
-\<<[email protected]>\> Thomas Nowicki
-\<<[email protected]>\> Vincent Renaville
-\<<[email protected]>\> Denis Leemann
-\<<[email protected]>\> Patrick Tombez
-\<<[email protected]>\> Don Kendall
-\<<[email protected]>\> Stephane Mangin
-\<<[email protected]>\> Laurent Mignon
-\<<[email protected]>\> Marie Lejeune
-\<<[email protected]>\> Wolfgang Pichler \<<[email protected]>\>
-Nans Lefebvre \<<[email protected]>\>
+* Thierry Ducrest \<<[email protected]>\> 
+* Guewen Baconnier \<<[email protected]>\>
+* Julien Coux \<<[email protected]>\>
+* Akim Juillerat \<<[email protected]>\>
+* Thomas Nowicki \<<[email protected]>\>
+* Vincent Renaville \<<[email protected]>\>
+* Denis Leemann \<<[email protected]>\>
+* Patrick Tombez \<<[email protected]>\>
+* Don Kendall \<<[email protected]>\>
+* Stephane Mangi \<<[email protected]>\>
+* Laurent Mignon \<<[email protected]>\>
+* Marie Lejeune \<<[email protected]>\>
+* Wolfgang Pichler \<<[email protected]>\>
+* Nans Lefebvre \<<[email protected]>\>
+* Mohamed Alkobrosli \<<[email protected]>\>