[FIX] ir_attachment: fix security issues on ir_attachment check: verify the permissions even when no ids are passed (skipped permission checking for create) create: verify has the write access on the related model (instead of create, was not checked anyway) function field: execute the write in fnct_inv as superuser (was impossible to have creation without write access)
[FIX] ir_attachment: fix security issues on ir_attachment
check: verify the permissions even when no ids are passed (skipped permission checking for create)
create: verify has the write access on the related model (instead of create, was not checked anyway)
function field: execute the write in fnct_inv as superuser (was impossible to have creation without write access)
MarkusTeufelberger/openobject-server,MarkusTeufelberger/openobject-server,MarkusTeufelberger/openobject-server