Security
What SharePoint Document Filing can read and write, what it stores, and what leaves your instance.
Filing is asynchronous
An attachment is created inside the transaction of whoever saved the record. Calling Microsoft there would mean saving an invoice fails when SharePoint is slow, and a tenant outage would stop people working.
So ir.attachment.create does one indexed lookup and queues, wrapped in a try that swallows its own failures on purpose. A person saving a record must never see our bookkeeping error.
The local copy is removed only on proof
The option that reclaims a filestore is the same one that could delete somebody's only copy of a contract.
The copy is removed only when Microsoft returned an item id and a link
- never on a call that merely did not error. A failed or partial upload leaves
the Odoo copy exactly where it was. test_the_local_copy_is_kept_when_the_upload_failed exists to fail if that ever stops being true.
Credentials
The client secret and the cached access token live in Odoo's encrypted ir.config_parameter store. No field on any model in this module holds either, and a test asserts it.
Setting a new secret invalidates the cached token, so the module cannot keep using a token obtained with a credential that has been replaced.
The secret is written only by a system administrator, through a transient wizard, and never displayed again.
Path safety
Folder templates are templates, not expressions. Every segment is sanitised against the characters SharePoint refuses - including the slash, which would otherwise let a record's display name create folders nobody intended - and .. is refused outright.
What is never filed
- Odoo's own machinery: ir.ui.view, ir.asset, report attachments
- Attachments backing a binary field, because moving one breaks the field
Who sees what
Ordinary users see the filings for documents they attached. The full log is an administrator's. The log is immutable: it is how you know where a document went.
Least privilege in Entra
Files.ReadWrite.All or Sites.ReadWrite.All are broad. If your tenant supports it, scope the app to specific sites with Sites.Selected and grant it only the library you file into.
Reporting a vulnerability
info@technovision.dev, with the Odoo version, the module version and enough detail to reproduce.