[IMP] base: tighten ir.model.data access rights

addons/web_tour/models/ir_ui_menu.py

@@ -18,7 +18,7 @@ class IrUiMenu(models.Model):
         menu_ids = [menu.id for menu in self.browse(menu_root['all_menu_ids']) if menu.load_xmlid]
         xmlids = {
             d.res_id: d.module + "." + d.name
-            for d in self.env['ir.model.data'].search([('res_id', 'in', menu_ids), ('model', '=', 'ir.ui.menu')])
+            for d in self.env['ir.model.data'].sudo().search([('res_id', 'in', menu_ids), ('model', '=', 'ir.ui.menu')])
         }
 
         def _find_subtree(tree, node_id):

addons/website_blog/models/website_blog.py

@@ -194,7 +194,7 @@ class BlogPost(models.Model):
                     'website_blog.blog_post_template_new_post',
                     subject=post.name,
                     values={'post': post},
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_blog.mt_blog_blog_published'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_blog.mt_blog_blog_published'))
             return True
         return False
 

addons/website_event_track/models/website_event_track.py

@@ -68,7 +68,7 @@ class Track(models.Model):
         res.message_post_with_view(
             'website_event_track.event_track_template_new',
             subject=res.name,
-            subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_event_track.mt_event_track'))
+            subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_event_track.mt_event_track'))
         return res
 
     @api.multi

addons/website_forum/models/forum.py

@@ -525,14 +525,14 @@ class Post(models.Model):
                     subject=_('Re: %s') % post.parent_id.name,
                     partner_ids=[(4, p.id) for p in tag_partners],
                     channel_ids=[(4, c.id) for c in tag_channels],
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_forum.mt_answer_new'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_forum.mt_answer_new'))
             elif post.state == 'active' and not post.parent_id:
                 post.message_post_with_view(
                     'website_forum.forum_post_template_new_question',
                     subject=post.name,
                     partner_ids=[(4, p.id) for p in tag_partners],
                     channel_ids=[(4, c.id) for c in tag_channels],
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_forum.mt_question_new'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_forum.mt_question_new'))
             elif post.state == 'pending' and not post.parent_id:
                 # TDE FIXME: in master, you should probably use a subtype;
                 # however here we remove subtype but set partner_ids
@@ -543,7 +543,7 @@ class Post(models.Model):
                     'website_forum.forum_post_template_validation',
                     subject=post.name,
                     partner_ids=partners.ids,
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('mail.mt_note'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('mail.mt_note'))
         return True
 
     @api.multi

odoo/addons/base/ir/ir_model.py

@@ -1030,7 +1030,7 @@ class IrModelData(models.Model):
         Return (id, res_model, res_id) or raise ValueError if not found
         """
         module, name = xmlid.split('.', 1)
-        xid = self.search([('module', '=', module), ('name', '=', name)])
+        xid = self.sudo().search([('module', '=', module), ('name', '=', name)])
         if not xid:
             raise ValueError('External ID not found in the system: %s' % xmlid)
         # the sql constraints ensure us we have only one result
@@ -1183,7 +1183,7 @@ class IrModelData(models.Model):
             existing_parents = set()            # {parent_model, ...}
             if xml_id:
                 for parent_model, parent_field in record._inherits.iteritems():
-                    xid = self.search([
+                    xid = self.sudo().search([
                         ('module', '=', module),
                         ('name', '=', xml_id + '_' + parent_model.replace('.', '_')),
                     ])

odoo/addons/base/ir/ir_ui_view.py

@@ -234,20 +234,20 @@ actual arch.
     def _compute_model_data_id(self):
         # get the first ir_model_data record corresponding to self
         domain = [('model', '=', 'ir.ui.view'), ('res_id', 'in', self.ids)]
-        for data in self.env['ir.model.data'].search_read(domain, ['res_id'], order='id desc'):
+        for data in self.env['ir.model.data'].sudo().search_read(domain, ['res_id'], order='id desc'):
             view = self.browse(data['res_id'])
             view.model_data_id = data['id']
 
     def _search_model_data_id(self, operator, value):
         name = 'name' if isinstance(value, basestring) else 'id'
         domain = [('model', '=', 'ir.ui.view'), (name, operator, value)]
-        data = self.env['ir.model.data'].search(domain)
+        data = self.env['ir.model.data'].sudo().search(domain)
         return [('id', 'in', data.mapped('res_id'))]
 
     def _compute_xml_id(self):
         xml_ids = collections.defaultdict(list)
         domain = [('model', '=', 'ir.ui.view'), ('res_id', 'in', self.ids)]
-        for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']):
+        for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']):
             xml_ids[data['res_id']].append("%s.%s" % (data['module'], data['name']))
         for view in self:
             view.xml_id = xml_ids.get(view.id, [''])[0]
@@ -994,7 +994,7 @@ actual arch.
     @tools.ormcache('self.id')
     def get_view_xmlid(self):
         domain = [('model', '=', 'ir.ui.view'), ('res_id', '=', self.id)]
-        xmlid = self.env['ir.model.data'].search_read(domain, ['module', 'name'])[0]
+        xmlid = self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name'])[0]
         return '%s.%s' % (xmlid['module'], xmlid['name'])
 
     @api.model

odoo/addons/base/module/module.py

@@ -86,7 +86,7 @@ class ModuleCategory(models.Model):
     def _compute_xml_id(self):
         xml_ids = defaultdict(list)
         domain = [('model', '=', self._name), ('res_id', 'in', self.ids)]
-        for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']):
+        for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']):
             xml_ids[data['res_id']].append("%s.%s" % (data['module'], data['name']))
         for cat in self:
             cat.xml_id = xml_ids.get(cat.id, [''])[0]
@@ -194,7 +194,7 @@ class Module(models.Model):
             # then, search and group ir.model.data records
             imd_models = defaultdict(list)
             imd_domain = [('module', '=', module.name), ('model', 'in', tuple(dmodels))]
-            for data in IrModelData.search(imd_domain):
+            for data in IrModelData.sudo().search(imd_domain):
                 imd_models[data.model].append(data.res_id)
 
             def browse(model):

odoo/addons/base/module/report/ir_module_reference_print.py

@@ -8,14 +8,14 @@ class IrModelReferenceReport(models.AbstractModel):
 
     @api.model
     def _object_find(self, module):
-        Data = self.env['ir.model.data']
+        Data = self.env['ir.model.data'].sudo()
         data = Data.search([('model','=','ir.model'), ('module','=',module.name)])
         res_ids = data.mapped('res_id')
         return self.env['ir.model'].browse(res_ids)
 
     @api.multi
     def _fields_find(self, model, module):
-        Data = self.env['ir.model.data']
+        Data = self.env['ir.model.data'].sudo()
         fname_wildcard = 'field_' + model.replace('.', '_') + '_%'
         data = Data.search([('model', '=', 'ir.model.fields'), ('module', '=', module.name), ('name', 'like', fname_wildcard)])
         if data:

odoo/addons/base/security/ir.model.access.csv

@@ -10,7 +10,6 @@
 "access_ir_model_access_group_erp_manager","ir_model_access_group_erp_manager","model_ir_model_access","group_erp_manager",1,1,1,1
 "access_ir_model_data_group_erp_manager","ir_model_data group_erp_manager","model_ir_model_data","group_erp_manager",1,1,1,1
 "access_ir_model_fields_group_erp_manager","ir_model_fields group_erp_manager","model_ir_model_fields","group_erp_manager",1,1,1,1
-"access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
 "access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1

odoo/models.py

@@ -4434,7 +4434,7 @@ class BaseModel(object):
         """
         result = {record.id: [] for record in self}
         domain = [('model', '=', self._name), ('res_id', 'in', self.ids)]
-        for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']):
+        for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']):
             result[data['res_id']].append('%(module)s.%(name)s' % data)
         return result