Found at origin/19.0 (0820667a) while running the spp_registry test suite for #418.
Summary
spp_registry/controllers/mail.py:64 (SPPThreadController.mail_message_update_content, the override of /mail/message/update_content) calls:
guest.env["ir.attachment"].browse(attachment_ids)._check_attachments_access(attachment_tokens)
_check_attachments_access no longer exists on ir.attachment in Odoo 19 (removed/renamed upstream after 18). Every call to the endpoint raises AttributeError, which surfaces as an error in the JSON-RPC envelope — so the endpoint is entirely non-functional: nobody, including the message author or an admin, can update a message through it.
Evidence
- Two ERROR-level tracebacks (
AttributeError: 'ir.attachment' object has no attribute '_check_attachments_access') fire on every spp_registry test run, from test_mail_controllers.py.
- The breakage is already documented in the test file itself:
spp_registry/tests/test_mail_controllers.py:196-216 — test_author_can_update_own_message and test_admin_can_update_any_message are skipped with BROKEN: controller calls removed Odoo 18 API, and the docstring notes that the bystander/unauth denial tests currently pass for the wrong reason (they see the AttributeError's error envelope, not a real access denial).
Suggested fix
Port the controller to whatever attachment-access validation replaced _check_attachments_access in Odoo 19 (per the TODO in the test docstring: fix the implementation, not the tests), then un-skip the two skipped tests. The bystander/unauth tests should then be re-verified to confirm they still deny for the right reason.
Found at
origin/19.0(0820667a) while running thespp_registrytest suite for #418.Summary
spp_registry/controllers/mail.py:64(SPPThreadController.mail_message_update_content, the override of/mail/message/update_content) calls:_check_attachments_accessno longer exists onir.attachmentin Odoo 19 (removed/renamed upstream after 18). Every call to the endpoint raisesAttributeError, which surfaces as anerrorin the JSON-RPC envelope — so the endpoint is entirely non-functional: nobody, including the message author or an admin, can update a message through it.Evidence
AttributeError: 'ir.attachment' object has no attribute '_check_attachments_access') fire on everyspp_registrytest run, fromtest_mail_controllers.py.spp_registry/tests/test_mail_controllers.py:196-216—test_author_can_update_own_messageandtest_admin_can_update_any_messageare skipped withBROKEN: controller calls removed Odoo 18 API, and the docstring notes that the bystander/unauth denial tests currently pass for the wrong reason (they see the AttributeError's error envelope, not a real access denial).Suggested fix
Port the controller to whatever attachment-access validation replaced
_check_attachments_accessin Odoo 19 (per the TODO in the test docstring: fix the implementation, not the tests), then un-skip the two skipped tests. The bystander/unauth tests should then be re-verified to confirm they still deny for the right reason.