Skip to content

[FIX] dms: allow unarchiving DMS files for non-superusers#471

Open
shagab99 wants to merge 1 commit intoOCA:18.0from
shagab99:18.0-fix-unarchive-dms-file
Open

[FIX] dms: allow unarchiving DMS files for non-superusers#471
shagab99 wants to merge 1 commit intoOCA:18.0from
shagab99:18.0-fix-unarchive-dms-file

Conversation

@shagab99
Copy link
Copy Markdown

@shagab99 shagab99 commented Apr 1, 2026

Summary

Fixed a bug where non-superuser users cannot unarchive DMS files even when they have full write permissions through DMS access groups.

Root Cause

_check_access_dms_record() in dms_security_mixin.py uses self.search(domain) to verify write permissions. By default, search() applies active_test=True, which excludes archived records (active=False).

When a user tries to unarchive a file via toggle_active():

  1. The write triggers _check_access_dms_record()
  2. The method searches for the file with the computed ir.rule domain
  3. But search() filters out archived records → file not found
  4. AccessError raised even though user has write permission

Fix

Add active_test=False context to the search in _check_access_dms_record() so archived records are included in the permission check.

Steps to reproduce

  1. Create a DMS file with proper access group permissions (write=True)
  2. Archive the file
  3. Try to unarchive (toggle_active) as a non-superuser
  4. AccessError: "Apply computed write permissions"

Testing

  • Unarchive works for users with write permission via DMS access groups
  • No impact on other permission checks (create, read, unlink)
  • Superuser behavior unchanged (already bypassed via self.env.su)

The _check_access_dms_record method uses self.search(domain) to verify
write permissions. However, search() applies active_test=True by default,
which excludes archived records (active=False).

This means when a user tries to unarchive a file via toggle_active(),
the write permission check cannot find the archived record in the search
results, causing an AccessError even when the user has full write
permissions through DMS access groups.

Fix: add active_test=False context to include archived records in the
permission check search.
@shagab99 shagab99 force-pushed the 18.0-fix-unarchive-dms-file branch from 8f3a708 to 86cc746 Compare April 1, 2026 08:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant