From 6453e4eb23f43b0508bdc6f613e225b0763e9f68 Mon Sep 17 00:00:00 2001 From: Raphael Collet Date: Mon, 28 Nov 2016 14:39:44 +0100 Subject: [PATCH] [IMP] base: tighten `ir.model.data` access rights --- addons/web_tour/models/ir_ui_menu.py | 2 +- addons/website_blog/models/website_blog.py | 2 +- addons/website_event_track/models/website_event_track.py | 2 +- addons/website_forum/models/forum.py | 6 +++--- odoo/addons/base/ir/ir_model.py | 4 ++-- odoo/addons/base/ir/ir_ui_view.py | 8 ++++---- odoo/addons/base/module/module.py | 4 ++-- .../base/module/report/ir_module_reference_print.py | 4 ++-- odoo/addons/base/security/ir.model.access.csv | 1 - odoo/models.py | 2 +- 10 files changed, 17 insertions(+), 18 deletions(-) diff --git a/addons/web_tour/models/ir_ui_menu.py b/addons/web_tour/models/ir_ui_menu.py index 81ca5e201c0..94a90e3a2ff 100644 --- a/addons/web_tour/models/ir_ui_menu.py +++ b/addons/web_tour/models/ir_ui_menu.py @@ -18,7 +18,7 @@ class IrUiMenu(models.Model): menu_ids = [menu.id for menu in self.browse(menu_root['all_menu_ids']) if menu.load_xmlid] xmlids = { d.res_id: d.module + "." + d.name - for d in self.env['ir.model.data'].search([('res_id', 'in', menu_ids), ('model', '=', 'ir.ui.menu')]) + for d in self.env['ir.model.data'].sudo().search([('res_id', 'in', menu_ids), ('model', '=', 'ir.ui.menu')]) } def _find_subtree(tree, node_id): diff --git a/addons/website_blog/models/website_blog.py b/addons/website_blog/models/website_blog.py index 4473ede211b..46e90fe4cd7 100644 --- a/addons/website_blog/models/website_blog.py +++ b/addons/website_blog/models/website_blog.py @@ -194,7 +194,7 @@ class BlogPost(models.Model): 'website_blog.blog_post_template_new_post', subject=post.name, values={'post': post}, - subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_blog.mt_blog_blog_published')) + subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_blog.mt_blog_blog_published')) return True return False diff --git a/addons/website_event_track/models/website_event_track.py b/addons/website_event_track/models/website_event_track.py index 58154b9bb9a..53e116641f4 100644 --- a/addons/website_event_track/models/website_event_track.py +++ b/addons/website_event_track/models/website_event_track.py @@ -68,7 +68,7 @@ class Track(models.Model): res.message_post_with_view( 'website_event_track.event_track_template_new', subject=res.name, - subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_event_track.mt_event_track')) + subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_event_track.mt_event_track')) return res @api.multi diff --git a/addons/website_forum/models/forum.py b/addons/website_forum/models/forum.py index 613195c7d25..84f9ed7c117 100644 --- a/addons/website_forum/models/forum.py +++ b/addons/website_forum/models/forum.py @@ -525,14 +525,14 @@ class Post(models.Model): subject=_('Re: %s') % post.parent_id.name, partner_ids=[(4, p.id) for p in tag_partners], channel_ids=[(4, c.id) for c in tag_channels], - subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_forum.mt_answer_new')) + subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_forum.mt_answer_new')) elif post.state == 'active' and not post.parent_id: post.message_post_with_view( 'website_forum.forum_post_template_new_question', subject=post.name, partner_ids=[(4, p.id) for p in tag_partners], channel_ids=[(4, c.id) for c in tag_channels], - subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_forum.mt_question_new')) + subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_forum.mt_question_new')) elif post.state == 'pending' and not post.parent_id: # TDE FIXME: in master, you should probably use a subtype; # however here we remove subtype but set partner_ids @@ -543,7 +543,7 @@ class Post(models.Model): 'website_forum.forum_post_template_validation', subject=post.name, partner_ids=partners.ids, - subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('mail.mt_note')) + subtype_id=self.env['ir.model.data'].xmlid_to_res_id('mail.mt_note')) return True @api.multi diff --git a/odoo/addons/base/ir/ir_model.py b/odoo/addons/base/ir/ir_model.py index 044d3b16f47..4785359063b 100644 --- a/odoo/addons/base/ir/ir_model.py +++ b/odoo/addons/base/ir/ir_model.py @@ -1030,7 +1030,7 @@ class IrModelData(models.Model): Return (id, res_model, res_id) or raise ValueError if not found """ module, name = xmlid.split('.', 1) - xid = self.search([('module', '=', module), ('name', '=', name)]) + xid = self.sudo().search([('module', '=', module), ('name', '=', name)]) if not xid: raise ValueError('External ID not found in the system: %s' % xmlid) # the sql constraints ensure us we have only one result @@ -1183,7 +1183,7 @@ class IrModelData(models.Model): existing_parents = set() # {parent_model, ...} if xml_id: for parent_model, parent_field in record._inherits.iteritems(): - xid = self.search([ + xid = self.sudo().search([ ('module', '=', module), ('name', '=', xml_id + '_' + parent_model.replace('.', '_')), ]) diff --git a/odoo/addons/base/ir/ir_ui_view.py b/odoo/addons/base/ir/ir_ui_view.py index 7f9d0340f02..039cbf1bd7c 100644 --- a/odoo/addons/base/ir/ir_ui_view.py +++ b/odoo/addons/base/ir/ir_ui_view.py @@ -234,20 +234,20 @@ actual arch. def _compute_model_data_id(self): # get the first ir_model_data record corresponding to self domain = [('model', '=', 'ir.ui.view'), ('res_id', 'in', self.ids)] - for data in self.env['ir.model.data'].search_read(domain, ['res_id'], order='id desc'): + for data in self.env['ir.model.data'].sudo().search_read(domain, ['res_id'], order='id desc'): view = self.browse(data['res_id']) view.model_data_id = data['id'] def _search_model_data_id(self, operator, value): name = 'name' if isinstance(value, basestring) else 'id' domain = [('model', '=', 'ir.ui.view'), (name, operator, value)] - data = self.env['ir.model.data'].search(domain) + data = self.env['ir.model.data'].sudo().search(domain) return [('id', 'in', data.mapped('res_id'))] def _compute_xml_id(self): xml_ids = collections.defaultdict(list) domain = [('model', '=', 'ir.ui.view'), ('res_id', 'in', self.ids)] - for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']): + for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']): xml_ids[data['res_id']].append("%s.%s" % (data['module'], data['name'])) for view in self: view.xml_id = xml_ids.get(view.id, [''])[0] @@ -994,7 +994,7 @@ actual arch. @tools.ormcache('self.id') def get_view_xmlid(self): domain = [('model', '=', 'ir.ui.view'), ('res_id', '=', self.id)] - xmlid = self.env['ir.model.data'].search_read(domain, ['module', 'name'])[0] + xmlid = self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name'])[0] return '%s.%s' % (xmlid['module'], xmlid['name']) @api.model diff --git a/odoo/addons/base/module/module.py b/odoo/addons/base/module/module.py index 233d12cb370..1f370493d3f 100644 --- a/odoo/addons/base/module/module.py +++ b/odoo/addons/base/module/module.py @@ -86,7 +86,7 @@ class ModuleCategory(models.Model): def _compute_xml_id(self): xml_ids = defaultdict(list) domain = [('model', '=', self._name), ('res_id', 'in', self.ids)] - for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']): + for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']): xml_ids[data['res_id']].append("%s.%s" % (data['module'], data['name'])) for cat in self: cat.xml_id = xml_ids.get(cat.id, [''])[0] @@ -194,7 +194,7 @@ class Module(models.Model): # then, search and group ir.model.data records imd_models = defaultdict(list) imd_domain = [('module', '=', module.name), ('model', 'in', tuple(dmodels))] - for data in IrModelData.search(imd_domain): + for data in IrModelData.sudo().search(imd_domain): imd_models[data.model].append(data.res_id) def browse(model): diff --git a/odoo/addons/base/module/report/ir_module_reference_print.py b/odoo/addons/base/module/report/ir_module_reference_print.py index 813662bf945..59749f88ebc 100644 --- a/odoo/addons/base/module/report/ir_module_reference_print.py +++ b/odoo/addons/base/module/report/ir_module_reference_print.py @@ -8,14 +8,14 @@ class IrModelReferenceReport(models.AbstractModel): @api.model def _object_find(self, module): - Data = self.env['ir.model.data'] + Data = self.env['ir.model.data'].sudo() data = Data.search([('model','=','ir.model'), ('module','=',module.name)]) res_ids = data.mapped('res_id') return self.env['ir.model'].browse(res_ids) @api.multi def _fields_find(self, model, module): - Data = self.env['ir.model.data'] + Data = self.env['ir.model.data'].sudo() fname_wildcard = 'field_' + model.replace('.', '_') + '_%' data = Data.search([('model', '=', 'ir.model.fields'), ('module', '=', module.name), ('name', 'like', fname_wildcard)]) if data: diff --git a/odoo/addons/base/security/ir.model.access.csv b/odoo/addons/base/security/ir.model.access.csv index 3bfbd759444..78e3949172a 100644 --- a/odoo/addons/base/security/ir.model.access.csv +++ b/odoo/addons/base/security/ir.model.access.csv @@ -10,7 +10,6 @@ "access_ir_model_access_group_erp_manager","ir_model_access_group_erp_manager","model_ir_model_access","group_erp_manager",1,1,1,1 "access_ir_model_data_group_erp_manager","ir_model_data group_erp_manager","model_ir_model_data","group_erp_manager",1,1,1,1 "access_ir_model_fields_group_erp_manager","ir_model_fields group_erp_manager","model_ir_model_fields","group_erp_manager",1,1,1,1 -"access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0 "access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1 diff --git a/odoo/models.py b/odoo/models.py index 06aab521071..ffae5004db1 100644 --- a/odoo/models.py +++ b/odoo/models.py @@ -4434,7 +4434,7 @@ class BaseModel(object): """ result = {record.id: [] for record in self} domain = [('model', '=', self._name), ('res_id', 'in', self.ids)] - for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']): + for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']): result[data['res_id']].append('%(module)s.%(name)s' % data) return result