[IMP] fs_attachment: use sudo() for accessing storage code in ir_attachment by CRogos · Pull Request #559 · OCA/storage

CRogos · 2026-03-06T16:15:08Z

Solves: #536

I don't know the exact reason why/when this happens, but from time to time users got access errors on attachments located in an Azure blob storage. We've added a stack trace (see below) for deeper analysis.
Since we've added these changes, these errors did not occur again.

2026-02-19 09:57:40,233 51698 ERROR c4a8-production-1830547 odoo.addons.c4a8_logging.models.ir_model_access: Access DENIED - User: xxxx (UID: 13), Model: fs.storage, Mode: read 
Stack (most recent call last):
  File "/usr/lib/python3.12/threading.py", line 1030, in _bootstrap
    self._bootstrap_inner()
  File "/usr/lib/python3.12/threading.py", line 1073, in _bootstrap_inner
    self.run()
  File "/usr/lib/python3.12/threading.py", line 1010, in run
    self._target(*self._args, **self._kwargs)
  File "/usr/lib/python3.12/socketserver.py", line 692, in process_request_thread
    self.finish_request(request, client_address)
  File "/usr/lib/python3.12/socketserver.py", line 362, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/home/odoo/src/odoo/odoo/service/server.py", line 128, in __init__
    super().__init__(*args, **kwargs)
  File "/usr/lib/python3.12/socketserver.py", line 761, in __init__
    self.handle()
  File "/usr/lib/python3/dist-packages/werkzeug/serving.py", line 390, in handle
    super().handle()
  File "/usr/lib/python3.12/http/server.py", line 436, in handle
    self.handle_one_request()
  File "/usr/lib/python3.12/http/server.py", line 424, in handle_one_request
    method()
  File "/usr/lib/python3/dist-packages/werkzeug/serving.py", line 362, in run_wsgi
    execute(self.server.app)
  File "/usr/lib/python3/dist-packages/werkzeug/serving.py", line 323, in execute
    application_iter = app(environ, start_response)
  File "/home/odoo/src/odoo/odoo/http.py", line 2576, in __call__
    response = request._serve_db()
  File "/home/odoo/src/odoo/odoo/http.py", line 2103, in _serve_db
    return self._transactioning(
  File "/home/odoo/src/odoo/odoo/http.py", line 2166, in _transactioning
    return service_model.retrying(func, env=self.env)
  File "/home/odoo/src/odoo/odoo/service/model.py", line 157, in retrying
    result = func()
  File "/home/odoo/src/odoo/odoo/http.py", line 2133, in _serve_ir_http
    response = self.dispatcher.dispatch(rule.endpoint, args)
  File "/home/odoo/src/odoo/odoo/http.py", line 2294, in dispatch
    return self.request.registry['ir.http']._dispatch(endpoint)
  File "/home/odoo/src/odoo/odoo/addons/base/models/ir_http.py", line 333, in _dispatch
    result = endpoint(**request.params)
  File "/home/odoo/src/odoo/odoo/http.py", line 754, in route_wrapper
    result = endpoint(self, *args, **params_ok)
  File "/home/odoo/src/odoo/addons/mail/models/discuss/mail_guest.py", line 38, in wrapper
    return func(self, *args, **kwargs)
  File "/home/odoo/src/odoo/addons/mail/controllers/discuss/binary.py", line 68, in content_image
    return super().content_image(*args, **kwargs)
  File "/home/odoo/src/odoo/odoo/http.py", line 754, in route_wrapper
    result = endpoint(self, *args, **params_ok)
  File "/home/odoo/src/odoo/addons/web/controllers/binary.py", line 185, in content_image
    stream = request.env['ir.binary']._get_image_stream_from(
  File "/home/odoo/src/user/modules/oca/storage/fs_attachment/models/ir_binary.py", line 137, in _get_image_stream_from
    stream.data = stream.read()
  File "/home/odoo/src/user/modules/oca/storage/fs_attachment/fs_stream.py", line 37, in read
    with self.fs_attachment.open("rb") as f:
  File "/home/odoo/src/user/modules/oca/storage/fs_attachment/models/ir_attachment.py", line 1011, in __enter__
    self._file_open()
  File "/home/odoo/src/user/modules/oca/storage/fs_attachment/models/ir_attachment.py", line 1031, in _file_open
    fs, _storage, fname = self.attachment._get_fs_parts()
  File "/home/odoo/src/user/modules/oca/storage/fs_attachment/models/ir_attachment.py", line 585, in _get_fs_parts
    return self._fs_parse_store_fname(self.store_fname)
  File "/home/odoo/src/user/modules/oca/storage/fs_attachment/models/ir_attachment.py", line 516, in _fs_parse_store_fname
    fs = self._get_fs_storage_for_code(storage_code)
  File "/home/odoo/src/user/modules/oca/storage/fs_attachment/models/ir_attachment.py", line 500, in _get_fs_storage_for_code
    fs = self.env["fs.storage"].get_fs_by_code(code)
  File "/home/odoo/src/user/modules/oca/storage/fs_storage/models/fs_storage.py", line 359, in get_fs_by_code
    use_cache = not force_no_cache and self._is_fs_cacheable(code)
  File "/usr/lib/python3/dist-packages/decorator.py", line 232, in fun
    return caller(func, *(extras + args), **kw)
  File "/home/odoo/src/odoo/odoo/tools/cache.py", line 110, in lookup
    value = d[key] = self.method(*args, **kwargs)
  File "/home/odoo/src/user/modules/oca/storage/fs_storage/models/fs_storage.py", line 339, in _is_fs_cacheable
    return fs_storage and fs_storage.is_cacheable
  File "/home/odoo/src/odoo/odoo/fields.py", line 1274, in __get__
    recs._fetch_field(self)
  File "/home/odoo/src/odoo/odoo/models.py", line 4115, in _fetch_field
    self.fetch(fnames)
  File "/home/odoo/src/odoo/odoo/models.py", line 4137, in fetch
    query = self.with_context(active_test=False)._search([('id', 'in', self.ids)])
  File "/home/odoo/src/odoo/odoo/models.py", line 5807, in _search
    self.browse().check_access('read')
  File "/home/odoo/src/odoo/odoo/models.py", line 4439, in check_access
    raise result[1]()
  File "/home/odoo/src/user/modules/c4a8/custom/c4a8_logging/models/ir_model_access.py", line 16, in _make_access_error
    _logger.error(
2026-02-19 09:57:40,233 51698 INFO c4a8-production-1830547 odoo.addons.base.models.ir_model: Access Denied by ACLs for operation: read, uid: 13, model: fs.storage

OCA-git-bot · 2026-03-06T16:15:14Z

Hi @lmignon,
some modules you are maintaining are being modified, check this out!

lmignon

Thank you for the fix @CRogos In my opinion (and it makes sense) the only required sudo to fix the problem is the one added into the `is_fs_cacheable' method. The others should be removed.

lmignon · 2026-03-06T16:44:46Z

fs_attachment/models/ir_attachment.py

        ):
            if self.attachment._is_file_from_a_storage(self.attachment.store_fname):
-                fs, _storage, fname = self.attachment._get_fs_parts()
+                fs, _storage, fname = self.attachment.sudo()._get_fs_parts()


according to the stack trace the only the sudo() required to fix the problem is the one added into the is_fs_cacheable method of the `fs.storage' model. This change should be revert.

Based on the provided stack traces I agree. I'll give it a try and wait for the feedback of the testers.

lmignon · 2026-03-06T16:45:37Z

fs_attachment/models/ir_attachment.py

                    new_filepath,
                ) = self.attachment._fs_parse_store_fname(new_store_fname)
-                _fs, _storage, old_filepath = self.attachment._get_fs_parts()
+                _fs, _storage, old_filepath = self.attachment.sudo()._get_fs_parts()


See previous comment.

…chment

CRogos · 2026-03-17T15:31:39Z

@lmignon could you update your code review? The failing tests belong to fs_image.

lmignon · 2026-03-17T15:56:35Z

@CRogos I've to fix the tests into fs_image before being able to merge your fix.

lmignon · 2026-03-18T07:26:07Z

@CRogos I've to fix the tests into fs_image before being able to merge your fix.

@CRogos see #567 for the fix for the tests

lmignon · 2026-03-18T12:15:00Z

/ocabot merge patch

OCA-git-bot · 2026-03-18T12:15:10Z

On my way to merge this fine PR!
Prepared branch 18.0-ocabot-merge-pr-559-by-lmignon-bump-patch, awaiting test results.

OCA-git-bot · 2026-03-18T12:18:31Z

Congratulations, your PR was merged at 8a035d5. Thanks a lot for contributing to OCA. ❤️

lmignon requested changes Mar 6, 2026

View reviewed changes

[IMP] fs_attachment: use sudo() for accessing storage code in ir_atta…

5a70923

…chment

CRogos force-pushed the 18.0-ticket-1298 branch from 35c86b8 to 5a70923 Compare March 9, 2026 08:09

lmignon approved these changes Mar 17, 2026

View reviewed changes

OCA-git-bot added the bot is merging ⏳ label Mar 18, 2026

OCA-git-bot merged commit 79433dc into OCA:18.0 Mar 18, 2026
3 of 5 checks passed

OCA-git-bot added merged 🎉 and removed bot is merging ⏳ labels Mar 18, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[IMP] fs_attachment: use sudo() for accessing storage code in ir_attachment#559

[IMP] fs_attachment: use sudo() for accessing storage code in ir_attachment#559
OCA-git-bot merged 1 commit intoOCA:18.0from
c4a8-odoo:18.0-ticket-1298

CRogos commented Mar 6, 2026 •

edited

Loading

Uh oh!

OCA-git-bot commented Mar 6, 2026

Uh oh!

lmignon left a comment

Uh oh!

lmignon Mar 6, 2026

Uh oh!

CRogos Mar 9, 2026

Uh oh!

lmignon Mar 6, 2026

Uh oh!

CRogos commented Mar 17, 2026

Uh oh!

lmignon commented Mar 17, 2026

Uh oh!

lmignon commented Mar 18, 2026

Uh oh!

lmignon commented Mar 18, 2026

Uh oh!

OCA-git-bot commented Mar 18, 2026

Uh oh!

Uh oh!

OCA-git-bot commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

CRogos commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

OCA-git-bot commented Mar 6, 2026

Uh oh!

lmignon left a comment

Choose a reason for hiding this comment

Uh oh!

lmignon Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

CRogos Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

lmignon Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

CRogos commented Mar 17, 2026

Uh oh!

lmignon commented Mar 17, 2026

Uh oh!

lmignon commented Mar 18, 2026

Uh oh!

lmignon commented Mar 18, 2026

Uh oh!

OCA-git-bot commented Mar 18, 2026

Uh oh!

Uh oh!

OCA-git-bot commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CRogos commented Mar 6, 2026 •

edited

Loading