Merge branch 'master' of https://github.com/espocrm/espocrm

application/Espo/Resources/metadata/app/acl.json

@@ -61,9 +61,6 @@
         "fieldLevel": {
         },
         "scopeFieldLevel": {
-            "Attachment": {
-                "parent": false
-            },
             "EmailFolder": {
                 "assignedUser": {
                     "read": "yes",

application/Espo/Resources/metadata/app/aclPortal.json

@@ -78,9 +78,6 @@
             "Meeting": {
                 "reminders": false
             },
-            "Attachment": {
-                "parent": false
-            },
             "Note": {
                 "isInternal": false,
                 "isGlobal": false

application/Espo/Services/Attachment.php

@@ -88,12 +88,32 @@ class Attachment extends Record
         }
     }
 
+    public function filterUpdateInput(StdClass $data): void
+    {
+        parent::filterUpdateInput($data);
+
+        unset($data->parentId);
+        unset($data->parentType);
+
+        unset($data->relatedId);
+        unset($data->relatedType);
+    }
+
     public function filterCreateInput(StdClass $data) : void
     {
         parent::filterCreateInput($data);
 
-        if (empty($data->file)) {
-            return;
+        unset($data->parentId);
+
+        unset($data->relatedId);
+        unset($data->relatedType);
+
+        if (!property_exists($data, 'file')) {
+            throw new BadRequest("No file contents.");
+        }
+
+        if (!is_string($data->file)) {
+            throw new BadRequest("Non-string file contents.");
         }
 
         $arr = explode(',', $data->file);