[IMP] restrict modules to system_group

* listing of modules in website already bypassed session user
* altered authenticated endpoint so it does the same
* sudoed a few read accesses & name_get in groups
* other accesses are list/form views, menu only accessible to
  system_user
* new-API-ified some calls & unified listing of installed modules

addons/mail/models/update.py

@@ -38,7 +38,7 @@ class publisher_warranty_contract(AbstractModel):
             nbr_active_share_users = user_count([("share", "=", True), ("login_date", ">=", limit_date_str)])
         user = Users.browse(cr, uid, uid)
         domain = [('application', '=', True), ('state', 'in', ['installed', 'to upgrade', 'to remove'])]
-        apps = self.pool['ir.module.module'].search_read(cr, uid, domain, ['name'])
+        apps = self.pool['ir.module.module'].search_read(cr, SUPERUSER_ID, domain, ['name'])
 
         web_base_url = get_param('web.base.url')
         msg = {

addons/web/controllers/main.py

@@ -24,6 +24,8 @@ from cStringIO import StringIO
 import babel.messages.pofile
 import werkzeug.utils
 import werkzeug.wrappers
+from openerp.api import Environment
+
 try:
     import xlwt
 except ImportError:
@@ -144,47 +146,31 @@ def ensure_db(redirect='/web/database/selector'):
 
     request.session.db = db
 
-def module_installed():
+def module_installed(environment):
     # Candidates module the current heuristic is the /static dir
     loadable = http.addons_manifest.keys()
-    modules = {}
 
     # Retrieve database installed modules
     # TODO The following code should move to ir.module.module.list_installed_modules()
-    Modules = request.session.model('ir.module.module')
+    Modules = environment['ir.module.module']
     domain = [('state','=','installed'), ('name','in', loadable)]
-    for module in Modules.search_read(domain, ['name', 'dependencies_id']):
-        modules[module['name']] = []
-        deps = module.get('dependencies_id')
-        if deps:
-            deps_read = request.session.model('ir.module.module.dependency').read(deps, ['name'])
-            dependencies = [i['name'] for i in deps_read]
-            modules[module['name']] = dependencies
+    modules = {
+        module.name: module.dependencies_id.mapped('name')
+        for module in Modules.search(domain)
+    }
 
     sorted_modules = topological_sort(modules)
     return sorted_modules
 
 def module_installed_bypass_session(dbname):
-    loadable = http.addons_manifest.keys()
-    modules = {}
     try:
         registry = openerp.modules.registry.RegistryManager.get(dbname)
         with registry.cursor() as cr:
-            m = registry.get('ir.module.module')
-            # TODO The following code should move to ir.module.module.list_installed_modules()
-            domain = [('state','=','installed'), ('name','in', loadable)]
-            ids = m.search(cr, 1, [('state','=','installed'), ('name','in', loadable)])
-            for module in m.read(cr, 1, ids, ['name', 'dependencies_id']):
-                modules[module['name']] = []
-                deps = module.get('dependencies_id')
-                if deps:
-                    deps_read = registry.get('ir.module.module.dependency').read(cr, 1, deps, ['name'])
-                    dependencies = [i['name'] for i in deps_read]
-                    modules[module['name']] = dependencies
-    except Exception,e:
+            return module_installed(
+                environment=Environment(cr, openerp.SUPERUSER_ID, {}))
+    except Exception:
         pass
-    sorted_modules = topological_sort(modules)
-    return sorted_modules
+    return {}
 
 def module_boot(db=None):
     server_wide_modules = openerp.conf.server_wide_modules or ['web']
@@ -816,7 +802,7 @@ class Session(http.Controller):
     @http.route('/web/session/modules', type='json', auth="user")
     def modules(self):
         # return all installed modules. Web client is smart enough to not load a module twice
-        return module_installed()
+        return module_installed(environment=request.env(user=openerp.SUPERUSER_ID))
 
     @http.route('/web/session/save_session_action', type='json', auth="user")
     def save_session_action(self, the_action):

addons/web_planner/models/web_planner.py

@@ -62,12 +62,12 @@ class Planner(models.Model):
             params['model'] = 'ir.module.module'
         # setting the module
         if module_name:
-            module = self.env['ir.module.module'].search([('name', '=', module_name)], limit=1)
+            module = self.env['ir.module.module'].sudo().search([('name', '=', module_name)], limit=1)
             if module:
                 params['id'] = module.id
         return "/web#%s" % (urlencode(params),)
 
     @api.model
     def is_module_installed(self, module_name=None):
-        count = self.env['ir.module.module'].search_count([('state', '=', 'installed'), ('name', '=', module_name)])
+        count = self.env['ir.module.module'].sudo().search_count([('state', '=', 'installed'), ('name', '=', module_name)])
         return bool(count)

addons/website/controllers/main.py

@@ -216,10 +216,10 @@ class Website(openerp.addons.web.controllers.main.Home):
                 modules_to_update.append(view.model_data_id.module)
 
         if modules_to_update:
-            module_obj = request.registry['ir.module.module']
-            module_ids = module_obj.search(request.cr, request.uid, [('name', 'in', modules_to_update)], context=request.context)
-            if module_ids:
-                module_obj.button_immediate_upgrade(request.cr, request.uid, module_ids, context=request.context)
+            module_obj = request.env['ir.module.module'].sudo()
+            modules = module_obj.search([('name', 'in', modules_to_update)])
+            if modules:
+                modules.button_immediate_upgrade()
         return request.redirect(redirect)
 
     @http.route('/website/customize_template_get', type='json', auth='user', website=True)
@@ -235,9 +235,11 @@ class Website(openerp.addons.web.controllers.main.Home):
 
     @http.route('/website/translations', type='json', auth="public", website=True)
     def get_website_translations(self, lang, mods=None):
-        module_obj = request.registry['ir.module.module']
-        module_ids = module_obj.search(request.cr, request.uid, [('name', 'ilike', 'website'), ('state', '=', 'installed')], context=request.context)
-        modules = [x['name'] for x in module_obj.read(request.cr, request.uid, module_ids, ['name'], context=request.context)]
+        Modules = request.env['ir.module.module'].sudo()
+        modules = Modules.search([
+            ('name', 'ilike', 'website'),
+            ('state', '=', 'installed')
+        ]).mapped('name')
         if mods:
             modules += mods
         return WebClient().translations(mods=modules, lang=lang)

openerp/addons/base/ir/ir_http.py

@@ -191,10 +191,14 @@ class ir_http(osv.AbstractModel):
     def routing_map(self):
         if not hasattr(self, '_routing_map'):
             _logger.info("Generating routing map")
-            cr = request.cr
-            m = request.registry.get('ir.module.module')
-            ids = m.search(cr, openerp.SUPERUSER_ID, [('state', '=', 'installed'), ('name', '!=', 'web')], context=request.context)
-            installed = set(x['name'] for x in m.read(cr, 1, ids, ['name'], context=request.context))
+            Modules = request.env['ir.module.module'].sudo()
+            installed = {
+                module.name
+                for module in Modules.search([
+                    ('state', '=', 'installed'),
+                    ('name', '!=', 'web')
+                ])
+            }
             if openerp.tools.config['test_enable']:
                 installed.add(openerp.modules.module.current_test)
             mods = [''] + openerp.conf.server_wide_modules + sorted(installed)

openerp/addons/base/res/res_users.py

@@ -35,7 +35,7 @@ class res_groups(osv.osv):
 
     def _get_full_name(self, cr, uid, ids, field, arg, context=None):
         res = {}
-        for g in self.browse(cr, uid, ids, context):
+        for g in self.browse(cr, SUPERUSER_ID, ids, context=context):
             if g.category_id:
                 res[g.id] = '%s / %s' % (g.category_id.name, g.name)
             else:

openerp/addons/base/security/ir.model.access.csv

@@ -17,11 +17,9 @@
 "access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
 "access_ir_model_fields_all","ir_model_fields all","model_ir_model_fields",,1,0,0,0
-"access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category",,1,0,0,0
+"access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_system",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1
-"access_ir_module_module_user","ir_module_module user","model_ir_module_module",,1,0,0,0
 "access_ir_module_module_dependency_group_system","ir_module_module_dependency group_system","model_ir_module_module_dependency","group_system",1,1,1,1
-"access_ir_module_module_dependency_all","ir_module_module_dependency all","model_ir_module_module_dependency",,1,0,0,0
 "access_ir_property_group_user","ir_property group_user","model_ir_property",,1,0,0,0
 "access_ir_property_group_user_manager","ir_property group_manager","model_ir_property","base.group_partner_manager",1,1,1,0
 "access_ir_rule_group_user","ir_rule group_user","model_ir_rule",,1,0,0,0