diff options
Diffstat (limited to 'odoo/addons/base/models/ir_http.py')
| -rw-r--r-- | odoo/addons/base/models/ir_http.py | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/odoo/addons/base/models/ir_http.py b/odoo/addons/base/models/ir_http.py index fc2f1a70318..eab07d2768e 100644 --- a/odoo/addons/base/models/ir_http.py +++ b/odoo/addons/base/models/ir_http.py @@ -278,10 +278,6 @@ class IrHttp(models.AbstractModel): obj = None if xmlid: obj = env.ref(xmlid, False) - elif id and model == 'ir.attachment' and access_token: - obj = env[model].sudo().browse(int(id)) - if not consteq(obj.access_token or '', access_token): - return (403, [], None) elif id and model in env.registry: obj = env[model].browse(int(id)) @@ -289,6 +285,12 @@ class IrHttp(models.AbstractModel): if not obj or not obj.exists() or field not in obj: return (404, [], None) + # access token grant access + if model == 'ir.attachment' and access_token: + obj = obj.sudo() + if not consteq(obj.access_token or '', access_token): + return (403, [], None) + # check read access try: last_update = obj['__last_update'] |