[IMP] base: tighten ir.model.fields access rights

addons/account/models/chart_template.py

@@ -226,7 +226,7 @@ class AccountChartTemplate(models.Model):
             account = getattr(self, record[0])
             value = account and 'account.account,' + str(acc_template_ref[account.id]) or False
             if value:
-                field = self.env['ir.model.fields'].search([('name', '=', record[0]), ('model', '=', record[1]), ('relation', '=', record[2])], limit=1)
+                field = self.env['ir.model.fields'].sudo().search([('name', '=', record[0]), ('model', '=', record[1]), ('relation', '=', record[2])])
                 vals = {
                     'name': record[0],
                     'company_id': company.id,

addons/crm/wizard/base_partner_merge.py

@@ -233,8 +233,8 @@ class MergePartnerAutomatic(models.TransientModel):
             update_records('marketing.campaign.workitem', src=partner, field_model='object_id.model')
             update_records('ir.model.data', src=partner)
 
-        records = self.env['ir.model.fields'].search([('ttype', '=', 'reference')])
-        for record in records.sudo():
+        records = self.env['ir.model.fields'].sudo().search([('ttype', '=', 'reference')])
+        for record in records:
             try:
                 Model = self.env[record.model]
                 field = Model._fields[record.name]
@@ -250,7 +250,7 @@ class MergePartnerAutomatic(models.TransientModel):
                 values = {
                     record.name: 'res.partner,%d' % dst_partner.id,
                 }
-                records_ref.sudo().write(values)
+                records_ref.write(values)
 
     @api.model
     def _update_values(self, src_partners, dst_partner):

addons/product/models/res_company.py

@@ -17,7 +17,7 @@ class ResCompany(models.Model):
                 'name': new_company.name,
                 'currency_id': new_company.currency_id.id,
             })
-        field = self.env['ir.model.fields'].search([('model', '=', 'res.partner'), ('name', '=', 'property_product_pricelist')])
+        field = self.env['ir.model.fields']._get('res.partner', 'property_product_pricelist')
         self.env['ir.property'].create({
             'name': 'property_product_pricelist',
             'company_id': new_company.id,

addons/stock_account/models/account_chart_template.py

@@ -21,7 +21,7 @@ class AccountChartTemplate(models.Model):
         PropertyObj = self.env['ir.property']  # Property Stock Journal
         value = self.env['account.journal'].search([('company_id', '=', company.id), ('code', '=', 'STJ'), ('type', '=', 'general')], limit=1)
         if value:
-            field = self.env['ir.model.fields'].search([('name', '=', 'property_stock_journal'), ('model', '=', 'product.category'), ('relation', '=', 'account.journal')], limit=1)
+            field = self.env['ir.model.fields'].sudo().search([('name', '=', 'property_stock_journal'), ('model', '=', 'product.category'), ('relation', '=', 'account.journal')])
             vals = {
                 'name': 'property_stock_journal',
                 'company_id': company.id,
@@ -45,7 +45,7 @@ class AccountChartTemplate(models.Model):
             account = getattr(self, record)
             value = account and 'account.account,' + str(acc_template_ref[account.id]) or False
             if value:
-                field = self.env['ir.model.fields'].search([('name', '=', record), ('model', '=', 'product.category'), ('relation', '=', 'account.account')], limit=1)
+                field = self.env['ir.model.fields'].sudo().search([('name', '=', record), ('model', '=', 'product.category'), ('relation', '=', 'account.account')])
                 vals = {
                     'name': record,
                     'company_id': company.id,

addons/web_diagram/controllers/main.py

@@ -76,7 +76,7 @@ class DiagramView(http.Controller):
             for i, fld in enumerate(connector_fields):
                 t['options'][connector_fields_string[i]] = tr[fld]
 
-        fields = http.request.env['ir.model.fields']
+        fields = http.request.env['ir.model.fields'].sudo()
         field = fields.search([('model', '=', model), ('relation', '=', node)])
         node_act = http.request.env[node]
         search_acts = node_act.search([(field.relation_field, '=', id)])

odoo/addons/base/ir/ir_model.py

@@ -399,6 +399,12 @@ class IrModelFields(models.Model):
                     'message': _("The table %r if used for other, possibly incompatible fields.") % self.relation_table,
                 }}
 
+    def _get(self, model_name, name):
+        """ Return the (sudoed) `ir.model.fields` record with the given model and name.
+        The result may be an empty recordset if the model is not found.
+        """
+        return self.sudo().search([('model', '=', model_name), ('name', '=', name)])
+
     @api.multi
     def _drop_column(self):
         tables_to_drop = set()

odoo/addons/base/ir/ir_translation.py

@@ -501,7 +501,7 @@ class IrTranslation(models.Model):
         :param model_name: the name of a model
         :return: the model's fields' strings as a dictionary `{field_name: field_string}`
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         return {field.name: field.field_description for field in fields}
 
     @api.model
@@ -513,7 +513,7 @@ class IrTranslation(models.Model):
         :param model_name: the name of a model
         :return: the model's fields' help as a dictionary `{field_name: field_help}`
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         return {field.name: field.help for field in fields}
 
     @api.multi
@@ -752,7 +752,7 @@ class IrTranslation(models.Model):
 
         :return: action definition to open the list of available translations
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         view = self.env.ref("base.view_translation_tree", False) or self.env['ir.ui.view']
         return {
             'name': _("Technical Translations"),

odoo/addons/base/module/report/ir_module_reference_print.py

@@ -20,7 +20,7 @@ class IrModelReferenceReport(models.AbstractModel):
         data = Data.search([('model', '=', 'ir.model.fields'), ('module', '=', module.name), ('name', 'like', fname_wildcard)])
         if data:
             res_ids = data.mapped('res_ids')
-            fnames = self.env['ir.model.fields'].browse(res_ids).mapped('name')
+            fnames = self.env['ir.model.fields'].sudo().browse(res_ids).mapped('name')
             return sorted(self.env[model].fields_get(fnames).iteritems())
         return []
 

odoo/addons/base/res/ir_property.py

@@ -79,7 +79,7 @@ class Property(models.Model):
                 else:
                     field_id = self.env['ir.model.fields'].browse(field_id)
 
-                value = '%s,%d' % (field_id.relation, value)
+                value = '%s,%d' % (field_id.sudo().relation, value)
 
         values[field] = value
         return values

odoo/addons/base/security/ir.model.access.csv

@@ -14,7 +14,6 @@
 "access_ir_model_access_all","ir_model_access_all","model_ir_model_access",,1,0,0,0
 "access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
-"access_ir_model_fields_all","ir_model_fields all","model_ir_model_fields",,1,0,0,0
 "access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1
 "access_ir_module_module_dependency_group_system","ir_module_module_dependency group_system","model_ir_module_module_dependency","group_system",1,1,1,1

odoo/report/custom.py

@@ -134,7 +134,7 @@ class report_custom(report_int):
                 field_child = f['field_child'+str(i)]
                 if field_child:
                     row.append(
-                        env['ir.model.fields'].browse(field_child[0]).name
+                        env['ir.model.fields'].sudo().browse(field_child[0]).name
                     )
                     if f['fc'+str(i)+'_operande']:
                         fct_name = 'id'
@@ -342,7 +342,7 @@ class report_custom(report_int):
         for f in fields:
             field_id = (f['field_child3'] and f['field_child3'][0]) or (f['field_child2'] and f['field_child2'][0]) or (f['field_child1'] and f['field_child1'][0]) or (f['field_child0'] and f['field_child0'][0])
             if field_id:
-                ttype = env['ir.model.fields'].browse(field_id).ttype
+                ttype = env['ir.model.fields'].sudo().browse(field_id).ttype
                 if ttype == 'date':
                     date_idx = idx
                     fct[idx] = process_date[report['frequency']] 
@@ -435,7 +435,7 @@ class report_custom(report_int):
         for f in fields:
             field_id = (f['field_child3'] and f['field_child3'][0]) or (f['field_child2'] and f['field_child2'][0]) or (f['field_child1'] and f['field_child1'][0]) or (f['field_child0'] and f['field_child0'][0])
             if field_id:
-                ttype = env['ir.model.fields'].browse(field_id).ttype
+                ttype = env['ir.model.fields'].sudo().browse(field_id).ttype
                 if ttype == 'date':
                     date_idx = idx
                     fct[idx] = process_date[report['frequency']]