Odoo 8 Error Downloading a file in the Website Module - odoo

Question

Good Day I've alter the website_hr_recruitment module to add some function to download some file. But an Error has occcured when I try to download the file without user access. The error is
{"message": "Odoo Server Error", "code": 200, "data": {"debug": "Traceback (most recent call last):\n File \"/opt/odoo/odoo-server/addons/web/controllers/main.py\", line 70, in wrap\n return f(*args, **kwargs)\n File \"/opt/odoo/odoo-server/addons/web/controllers/main.py\", line 1092, in saveas\n res = Model.read(cr, uid, [int(id)], fields, context)[0]\n File \"/opt/odoo/odoo-server/openerp/api.py\", line 268, in wrapper\n return old_api(self, *args, **kwargs)\n File \"/opt/odoo/odoo-server/openerp/addons/base/ir/ir_attachment.py\", line 318, in read\n self.check(cr, uid, ids, 'read', context=context)\n File \"/opt/odoo/odoo-server/openerp/api.py\", line 268, in wrapper\n return old_api(self, *args, **kwargs)\n File \"/opt/odoo/odoo-server/openerp/addons/base/ir/ir_attachment.py\", line 260, in check\n raise except_orm(_('Access Denied'), _(\"Sorry, you are not allowed to access this document.\"))\nexcept_orm: (u'Access Denied', u'Sorry, you are not allowed to access this document.')\n", "exception_type": "except_osv", "message": "Access Denied\nSorry, you are not allowed to access this document.", "name": "openerp.exceptions.except_orm", "arguments": ["Access Denied", "Sorry, you are not allowed to access this document."]}}
Heres the Model
#http.route('/jobs/apply/<model("hr.job"):job>', type='http', auth="public", website=True)
def jobs_apply(self, job):
error = {}
default = {}
#Added by SDS 19022016
attachment = http.request.env['ir.attachment'].sudo().search([('name', '=', 'Application-Form-rev2.docx')])
#str_url = 'http://localhost:8069'+'/web/binary/saveas?model=ir.attachment&field=datas&filename_field=name&id='+str(attachment.id)
str_url = request.httprequest.host_url +'web/binary/saveas?model=ir.attachment&field=datas&filename_field=name&id='+str(attachment.id)
if 'website_hr_recruitment_bahia_error' in request.session:
error = request.session.pop('website_hr_recruitment_bahia_error')
default = request.session.pop('website_hr_recruitment_bahia_default')
return request.render("website_hr_recruitment_bahia.apply", {
'job': job,
'error': error,
'default': default,
'url_link': str_url,
})
and heres the Template
<div t-attf-class="form-group #{error.get('first_name') and 'has-error' or ''}">
Click ”<a t-att-href="url_link" >Apply Now</a> ” to download, fill-out and upload below
<label class="col-md-3 col-sm-4 control-label" for="first_name">First Name</label>
<div class="col-md-7 col-sm-8">
<input type="text" t-att-value="default.get('first_name')" class="form-control" name="first_name" required="True"/>
</div>
</div>
I tried to add the sudo access but it has no use can someone help me
Thanks

Answer 1

Please create a security file named - ir.model.access.csv
Add it in __openerp__.py like this -
'data': [
'security/ir.model.access.csv',
'views/your_view.xml',
]
Above security is the folder name and in it the file ir.model.access.csv exist.
And add following lines to your csv file-
id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
access_YOUR_CLASS_NAME,access_YOUR_CLASS_NAME,model_YOUR_CLASS_NAME,,1,1,1,1
This should solve the access problem.

Answer 2

Unfortunately, v8 has a more restrictive policy on ir.attachment object and it only let Employee (base.group_user) group read all document i.e. user have to be logged in to access the document(s). So adding record rule or Access Control List rule will not help you.
The best solution here it's to over-ride the def check method on ir.attachment and make more relax to checking the security of accessing documents publically, or maybe you can just over-ride and do not put any logic and make object security driven by ir.attachment. or you can also let some model document bypass from security check.
Hope this will help you.
Bests