This module restricts attachment uploads to an explicit allowlist of MIME types using content-based detection rather than filename extensions. Only configured MIME types are accepted; everything else is rejected. Leaving the allowlist empty disables the restriction and allows all file types.
For incoming emails, the email itself is always accepted, but any attachments whose MIME type is not in the allowlist are stripped out before the message is saved. A security notice is then posted on the related record listing the removed files, so users can see what was filtered.
auto_awesome What this module does
AI-generated from the code · Odoo 15.0Restrict which file types can be uploaded as attachments by listing allowed MIME types, either company-wide or per model. Incoming email attachments that are not allowed are removed and a security notice is posted.
This module lets you control which kinds of files can be attached in Odoo, based on the real file content rather than the file name extension.
- In Settings, under the email settings area, you get an "Allowed Attachment Types" field where you enter a comma-separated list such as image/png,application/pdf. Leave it empty to allow every file type.
- On each model's configuration screen (the technical model form), there is an "Attachment Validation" group with the same field, so you can set a different allowlist for a specific model. If left empty, the company-wide list is used.
- When a user uploads a file, Odoo checks its detected type against the allowlist. If the type is not allowed, the upload is refused with a message saying the file type is not allowed.
- The same check runs when an attachment is modified (content, type, linked model or company).
- For incoming emails, the message itself is always kept, but attachments whose type is not allowed are stripped out before saving. A security notice is then posted on the related record listing the blocked file names and types.
- If a file's type cannot be analysed, it is blocked by default.
The module extends ir.attachment, ir.model, res.company, res.config.settings and mail.thread.
Depends on
Models and fields (4)
- ir.model · extends an existing modelattachment_allowed_mimetypes (Allowed Attachment Types)
- res.company · extends an existing modelattachment_allowed_mimetypes (Allowed Attachment Types)
- ir.attachment · extends an existing model
- res.config.settings · extends an existing modelattachment_allowed_mimetypes (Allowed Attachment Types)
Text generated by AI (DeepSeek) from reading the Odoo 15.0 code on GitHub; it may contain mistakes, so check the code before deciding. View the code on GitHub
Availability by version
Reviewed: 2026-11-03Confirmation status: 1 confirmed, 8 with no information of 9 versions.
Sources · Odoo 15.0
Confirmed on 2026-11-03 in branch 15.0 of OCA/social.
terminal Installation and usage
OCA documentation · Odoo 15.0Configuration
Source · Odoo 15.0Global Configuration (Company-wide):
- Go to Settings → General Settings
- In the "Allowed Attachment Types" field, enter comma-separated MIME types
- Example:
image/png,application/pdf - Leave empty to allow all file types
Per-Model Configuration (Optional):
- Go to Settings → Technical → Database Structure → Models
- Select a model (e.g., "Contact" for res.partner)
- In the "Allowed Attachment Types" field, enter comma-separated MIME types
- Empty value = use global config; set value = override global config
Configuration Hierarchy:
Per-model settings override global settings when defined.
No verified information in OCA: Installation, Usage.
Installation instructions, the distribution package, dependencies and configuration steps are not shown because they have not yet been verified in the module documentation for any version.
Data imported from GitHub: this sheet reflects the latest catalog review, not a live lookup. Always check the module documentation and staging before installing in production.