From b80e890fd6be69235ec59bd69e2d9275d4f46992 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Fri, 2 Apr 2021 15:31:20 +0300
Subject: [PATCH 1/2] attachment fix

---
 application/Espo/Resources/metadata/app/acl.json |  3 ---
 .../Espo/Resources/metadata/app/aclPortal.json   |  3 ---
 application/Espo/Services/Attachment.php         | 16 ++++++++++++++++
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/application/Espo/Resources/metadata/app/acl.json b/application/Espo/Resources/metadata/app/acl.json
index 03ce485858..f2132e5cd5 100644
--- a/application/Espo/Resources/metadata/app/acl.json
+++ b/application/Espo/Resources/metadata/app/acl.json
@@ -61,9 +61,6 @@
         "fieldLevel": {
         },
         "scopeFieldLevel": {
-            "Attachment": {
-                "parent": false
-            },
             "EmailFolder": {
                 "assignedUser": {
                     "read": "yes",
diff --git a/application/Espo/Resources/metadata/app/aclPortal.json b/application/Espo/Resources/metadata/app/aclPortal.json
index c697c6bf28..3b444295b7 100644
--- a/application/Espo/Resources/metadata/app/aclPortal.json
+++ b/application/Espo/Resources/metadata/app/aclPortal.json
@@ -78,9 +78,6 @@
             "Meeting": {
                 "reminders": false
             },
-            "Attachment": {
-                "parent": false
-            },
             "Note": {
                 "isInternal": false,
                 "isGlobal": false
diff --git a/application/Espo/Services/Attachment.php b/application/Espo/Services/Attachment.php
index 43330497b3..f7a100fa31 100644
--- a/application/Espo/Services/Attachment.php
+++ b/application/Espo/Services/Attachment.php
@@ -88,10 +88,26 @@ class Attachment extends Record
         }
     }
 
+    public function filterUpdateInput(StdClass $data): void
+    {
+        parent::filterUpdateInput($data);
+
+        unset($data->parentId);
+        unset($data->parentType);
+
+        unset($data->relatedId);
+        unset($data->relatedType);
+    }
+
     public function filterCreateInput(StdClass $data) : void
     {
         parent::filterCreateInput($data);
 
+        unset($data->parentId);
+
+        unset($data->relatedId);
+        unset($data->relatedType);
+
         if (empty($data->file)) {
             return;
         }

From 13cec0dd3110e60c34e4b3a870c1938378740dfb Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Fri, 2 Apr 2021 15:37:30 +0300
Subject: [PATCH 2/2] attachment fix

---
 application/Espo/Services/Attachment.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/application/Espo/Services/Attachment.php b/application/Espo/Services/Attachment.php
index f7a100fa31..86cfc66deb 100644
--- a/application/Espo/Services/Attachment.php
+++ b/application/Espo/Services/Attachment.php
@@ -108,8 +108,12 @@ class Attachment extends Record
         unset($data->relatedId);
         unset($data->relatedType);
 
-        if (empty($data->file)) {
-            return;
+        if (!property_exists($data, 'file')) {
+            throw new BadRequest("No file contents.");
+        }
+
+        if (!is_string($data->file)) {
+            throw new BadRequest("Non-string file contents.");
         }
 
         $arr = explode(',', $data->file);