Skip to content

[15.0][ADD] attachment_mimetype_restriction#1857

Open
AungKoKoLin1997 wants to merge 1 commit into
OCA:15.0from
qrtl:15.0-add-attachment_mimetype_restriction
Open

[15.0][ADD] attachment_mimetype_restriction#1857
AungKoKoLin1997 wants to merge 1 commit into
OCA:15.0from
qrtl:15.0-add-attachment_mimetype_restriction

Conversation

@AungKoKoLin1997

@AungKoKoLin1997 AungKoKoLin1997 commented Apr 27, 2026

Copy link
Copy Markdown

This module blocks specific MIME types from being uploaded as attachments using content-based detection rather than filename extensions. This prevents uploading potentially dangerous files (executables, scripts, etc.).

@qrtl QT5832

@OCA-git-bot OCA-git-bot added series:15.0 mod:attachment_mimetype_restriction Module attachment_mimetype_restriction labels Apr 27, 2026
@AungKoKoLin1997 AungKoKoLin1997 force-pushed the 15.0-add-attachment_mimetype_restriction branch 2 times, most recently from 8138261 to 556a7c0 Compare April 28, 2026 02:06
@AungKoKoLin1997 AungKoKoLin1997 marked this pull request as ready for review April 28, 2026 02:07
@AungKoKoLin1997 AungKoKoLin1997 force-pushed the 15.0-add-attachment_mimetype_restriction branch 2 times, most recently from 89a3294 to 232a014 Compare April 30, 2026 05:08
Comment thread attachment_mimetype_restriction/models/ir_attachment.py
@AungKoKoLin1997 AungKoKoLin1997 force-pushed the 15.0-add-attachment_mimetype_restriction branch from 232a014 to 061ca2a Compare May 8, 2026 04:26
@AungKoKoLin1997 AungKoKoLin1997 marked this pull request as draft May 19, 2026 01:16

@NL66278 NL66278 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 LGTM

@AungKoKoLin1997 AungKoKoLin1997 force-pushed the 15.0-add-attachment_mimetype_restriction branch from 061ca2a to 97c3b78 Compare May 21, 2026 03:20
@AungKoKoLin1997 AungKoKoLin1997 marked this pull request as ready for review May 21, 2026 03:20
@SanamiK

SanamiK commented Jun 9, 2026

Copy link
Copy Markdown

Here is a summary of what I tested and the issues I found.

What I tested
I tried to attach a non-allowed type file in Send Invoice dialog in the Invoicing module.

Issue 1: Internal Odoo files are incorrectly blocked
Before even attaching a file, internal Odoo operations were being blocked. Configuring the document layout (company logo, font, or colors) triggers a ValidationError for text/scss.
Invoicing_Send_Invoice
text

Issue 2: Adding text/scss to the allowlist causes a different error
As a workaround for Issue 1, I added text/scss to the allowlist. This time, an application/octet-stream error occurred. It appears that legitimate files(PDF) processed internally by Odoo are also being blocked.
application

Issue 3: Users are not shown a meaningful error message in some cases
When a user tries to attach a non-allowed file type, the generic message "Something horrible happened" is shown instead of a specific validation message. The user has no way to tell what went wrong.
スクリーンショット 2026-06-09 104009

@AungKoKoLin1997 AungKoKoLin1997 force-pushed the 15.0-add-attachment_mimetype_restriction branch from 97c3b78 to fb7b4b5 Compare June 9, 2026 04:21

@SanamiK SanamiK left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Functional review. LGTM!

I checked the behavior with settings applied to all models and settings applied to individual models.

Image Image

@OCA-git-bot

Copy link
Copy Markdown
Contributor

This PR has the approved label and has been created more than 5 days ago. It should therefore be ready to merge by a maintainer (or a PSC member if the concerned addon has no declared maintainer). 🤖

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants