[FIX] mail: prevent from modifying subtypes

Prior this commit:
In mail subtype, any users could have perform modification on it.

After this commit:
Now user have only access to read and only admin can do all the modifications.

Task-3245940

closes odoo/odoo#127539

X-original-commit: 1b99f9b6608793612dda72007a4ca2258373a97f
Signed-off-by: Stéphane Debauche (std) <std@odoo.com>

addons/mail/security/ir.model.access.csv

@@ -30,7 +30,8 @@ access_mail_gateway_allowed_system,mail.gateway.allowed.system,model_mail_gatewa
 access_mail_message_reaction_all,mail.message.reaction.all,model_mail_message_reaction,,0,0,0,0
 access_mail_message_reaction_system,mail.message.reaction.system,model_mail_message_reaction,base.group_system,1,1,1,1
 access_mail_message_subtype_all,mail.message.subtype.all,model_mail_message_subtype,,1,0,0,0
-access_mail_message_subtype_user,mail.message.subtype.user,model_mail_message_subtype,base.group_user,1,1,1,1
+access_mail_message_subtype_user,mail.message.subtype.user,model_mail_message_subtype,base.group_user,1,0,0,0
+access_mail_message_subtype_system,mail.message.subtype.system,model_mail_message_subtype,base.group_system,1,1,1,1
 access_mail_tracking_value_all,mail.tracking.value.all,model_mail_tracking_value,,0,0,0,0
 access_mail_tracking_value_portal,mail.tracking.value.portal,model_mail_tracking_value,base.group_portal,0,0,0,0
 access_mail_tracking_value_user,mail.tracking.value.user,model_mail_tracking_value,base.group_user,0,0,0,0

addons/test_mail/tests/__init__.py

@@ -19,3 +19,4 @@ from . import test_message_track
 from . import test_performance
 from . import test_ui
 from . import test_mail_management
+from . import test_mail_security

addons/test_mail/tests/test_mail_message.py

@@ -70,7 +70,7 @@ class TestMessageValues(MailCommon):
         self.assertFalse(message.sudo()._filter_empty(), 'Still having attachments')
 
         # Subtype content
-        note_subtype.write({'description': 'Very important discussions'})
+        note_subtype.sudo().write({'description': 'Very important discussions'})
         record._message_update_content(message, '', [])
         self.assertFalse(message.attachment_ids)
         self.assertEqual(message.notified_partner_ids, self.partner_admin)
@@ -78,7 +78,7 @@ class TestMessageValues(MailCommon):
         self.assertFalse(message.sudo()._filter_empty(), 'Subtype with description')
 
         # Completely void now
-        note_subtype.write({'description': ''})
+        note_subtype.sudo().write({'description': ''})
         self.assertEqual(message.sudo()._filter_empty(), message)
         record._message_update_content(message, '', [])
         self.assertFalse(message.notified_partner_ids)

addons/test_mail/tests/test_mail_security.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo.addons.mail.tests.common import mail_new_test_user, MailCommon
+from odoo.exceptions import AccessError
+
+
+class TestSubtypeAccess(MailCommon):
+
+    def test_subtype_access(self):
+        """
+        The function aims to formally verify the access restrictions on mail.message.subtype for
+        normal and admin users. It ensures that normal users are unable to modify it,
+        while admin users possess the necessary privileges to modify it successfully.
+        """
+
+        test_subtype = self.env['mail.message.subtype'].create({
+            'name': 'Test',
+            'description': 'only description',
+        })
+
+        user = mail_new_test_user(self.env, 'Internal user', groups='base.group_user')
+
+        with self.assertRaises(AccessError):
+            test_subtype.with_user(user).write({'description': 'changing description'})
+
+        test_subtype.with_user(self.user_admin).write({'description': 'testing'})
+        self.assertEqual(test_subtype.description, 'testing')