[MERGE] base: tighten access rights of ir.* models

addons/account/models/chart_template.py

@@ -226,7 +226,7 @@ class AccountChartTemplate(models.Model):
             account = getattr(self, record[0])
             value = account and 'account.account,' + str(acc_template_ref[account.id]) or False
             if value:
-                field = self.env['ir.model.fields'].search([('name', '=', record[0]), ('model', '=', record[1]), ('relation', '=', record[2])], limit=1)
+                field = self.env['ir.model.fields'].sudo().search([('name', '=', record[0]), ('model', '=', record[1]), ('relation', '=', record[2])])
                 vals = {
                     'name': record[0],
                     'company_id': company.id,

addons/anonymization/models/anonymization.py

@@ -59,11 +59,8 @@ class IrModelFieldsAnonymization(models.Model):
     @api.model
     def _get_model_and_field_ids(self, vals):
         if vals.get('field_name') and vals.get('model_name'):
-            model_id = self.env['ir.model'].search([('model', '=', vals['model_name'])], limit=1).id
-            if model_id:
-                field_id = self.env['ir.model.fields'].search([('name', '=', vals['field_name']), ('model_id', '=', model_id)], limit=1).id
-                if field_id:
-                    return (model_id, field_id)
+            field = self.env['ir.model.fields']._get(vals['model_name'], vals['field_name'])
+            return (field.model_id.id, field.id)
         return (False, False)
 
     @api.model
@@ -109,17 +106,12 @@ class IrModelFieldsAnonymization(models.Model):
     def _onchange_model_name(self):
         self.field_name = False
         self.field_id = False
-        if self.model_name:
-            self.model_id = self.env['ir.model'].search([('model', '=', self.model_name)], limit=1)
-        else:
-            self.model_id = False
+        self.model_id = self.env['ir.model']._get(self.model_name)
 
     @api.onchange('field_name')
     def _onchange_field_name(self):
         if self.field_name and self.model_name:
-            self.field_id = self.env['ir.model.fields'].search([
-                ('name', '=', self.field_name), ('model', '=', self.model_name)
-            ], limit=1)
+            self.field_id = self.env['ir.model.fields']._get(self.model_name, self.field_name)
         else:
             self.field_id = False
 

addons/auth_signup/controllers/main.py

@@ -70,10 +70,10 @@ class AuthSignupHome(Home):
     def get_auth_signup_config(self):
         """retrieve the module config (which features are enabled) for the login page"""
 
-        IrConfigParam = request.env['ir.config_parameter']
+        get_param = request.env['ir.config_parameter'].sudo().get_param
         return {
-            'signup_enabled': IrConfigParam.sudo().get_param('auth_signup.allow_uninvited') == 'True',
-            'reset_password_enabled': IrConfigParam.sudo().get_param('auth_signup.reset_password') == 'True',
+            'signup_enabled': get_param('auth_signup.allow_uninvited') == 'True',
+            'reset_password_enabled': get_param('auth_signup.reset_password') == 'True',
         }
 
     def get_auth_signup_qcontext(self):

addons/auth_signup/models/res_config.py

@@ -13,19 +13,19 @@ class BaseConfigSettings(models.TransientModel):
 
     @api.model
     def get_default_auth_signup_template_user_id(self, fields):
-        IrConfigParam = self.env['ir.config_parameter']
+        get_param = self.env['ir.config_parameter'].get_param
         # we use safe_eval on the result, since the value of the parameter is a nonempty string
         return {
-            'auth_signup_reset_password': safe_eval(IrConfigParam.get_param('auth_signup.reset_password', 'False')),
-            'auth_signup_uninvited': safe_eval(IrConfigParam.get_param('auth_signup.allow_uninvited', 'False')),
-            'auth_signup_template_user_id': safe_eval(IrConfigParam.get_param('auth_signup.template_user_id', 'False')),
+            'auth_signup_reset_password': safe_eval(get_param('auth_signup.reset_password', 'False')),
+            'auth_signup_uninvited': safe_eval(get_param('auth_signup.allow_uninvited', 'False')),
+            'auth_signup_template_user_id': safe_eval(get_param('auth_signup.template_user_id', 'False')),
         }
 
     @api.multi
     def set_auth_signup_template_user_id(self):
         self.ensure_one()
-        IrConfigParam = self.env['ir.config_parameter']
+        set_param = self.env['ir.config_parameter'].set_param
         # we store the repr of the values, since the value of the parameter is a required string
-        IrConfigParam.set_param('auth_signup.reset_password', repr(self.auth_signup_reset_password))
-        IrConfigParam.set_param('auth_signup.allow_uninvited', repr(self.auth_signup_uninvited))
-        IrConfigParam.set_param('auth_signup.template_user_id', repr(self.auth_signup_template_user_id.id))
+        set_param('auth_signup.reset_password', repr(self.auth_signup_reset_password))
+        set_param('auth_signup.allow_uninvited', repr(self.auth_signup_uninvited))
+        set_param('auth_signup.template_user_id', repr(self.auth_signup_template_user_id.id))

addons/auth_signup/models/res_partner.py

@@ -52,7 +52,7 @@ class ResPartner(models.Model):
             the url state components (menu_id, id, view_type) """
 
         res = dict.fromkeys(self.ids, False)
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for partner in self:
             # when required, make sure the partner has a valid signup token
             if self.env.context.get('signup_valid') and not partner.user_ids:

addons/auth_signup/models/res_users.py

@@ -75,14 +75,14 @@ class ResUsers(models.Model):
     @api.model
     def _signup_create_user(self, values):
         """ create a new user from the template user """
-        IrConfigParam = self.env['ir.config_parameter']
-        template_user_id = literal_eval(IrConfigParam.get_param('auth_signup.template_user_id', 'False'))
+        get_param = self.env['ir.config_parameter'].sudo().get_param
+        template_user_id = literal_eval(get_param('auth_signup.template_user_id', 'False'))
         template_user = self.browse(template_user_id)
         assert template_user.exists(), 'Signup: invalid template user'
 
         # check that uninvited users may sign up
         if 'partner_id' not in values:
-            if not literal_eval(IrConfigParam.get_param('auth_signup.allow_uninvited', 'False')):
+            if not literal_eval(get_param('auth_signup.allow_uninvited', 'False')):
                 raise SignupError('Signup is not allowed for uninvited users')
 
         assert values.get('login'), "Signup: no login given for new user"

addons/base_gengo/wizard/base_gengo_translations.py

@@ -47,8 +47,8 @@ class BaseGengoTranslations(models.TransientModel):
     @api.model_cr
     def init(self):
         icp = self.env['ir.config_parameter'].sudo()
-        if not icp.get_param(self.GENGO_KEY, default=None):
-            icp.set_param(self.GENGO_KEY, str(uuid.uuid4()), groups=self.GROUPS)
+        if not icp.get_param(self.GENGO_KEY):
+            icp.set_param(self.GENGO_KEY, str(uuid.uuid4()))
 
     @api.model_cr
     def get_gengo_key(self):
@@ -206,7 +206,7 @@ class BaseGengoTranslations(models.TransientModel):
                 'term2.id': {...}
                 }
             }'''
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         IrTranslation = self.env['ir.translation']
         jobs = {}
         user = self.env.user

addons/calendar/models/calendar.py

@@ -131,7 +131,7 @@ class Attendee(models.Model):
         """
         res = False
 
-        if self.env['ir.config_parameter'].get_param('calendar.block_mail') or self._context.get("no_mail_to_attendees"):
+        if self.env['ir.config_parameter'].sudo().get_param('calendar.block_mail') or self._context.get("no_mail_to_attendees"):
             return res
 
         calendar_view = self.env.ref('calendar.view_calendar_event_calendar')
@@ -152,7 +152,7 @@ class Attendee(models.Model):
             'color': colors,
             'action_id': self.env['ir.actions.act_window'].search([('view_id', '=', calendar_view.id)], limit=1).id,
             'dbname': self._cr.dbname,
-            'base_url': self.env['ir.config_parameter'].get_param('web.base.url', default='http://localhost:8069')
+            'base_url': self.env['ir.config_parameter'].sudo().get_param('web.base.url', default='http://localhost:8069')
         })
         invitation_template = invitation_template.with_context(rendering_context)
 

addons/crm/models/res_config.py

@@ -10,7 +10,7 @@ class CRMSettings(models.TransientModel):
     generate_sales_team_alias = fields.Boolean("Automatically generate an email alias at the sales team creation",
         help="Odoo will generate an email alias based on the sales team name")
     alias_prefix = fields.Char('Default Alias Name for Leads')
-    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
     default_generate_lead_from_alias = fields.Boolean(default_model='sale.config.settings')
     group_use_lead = fields.Boolean(string="Leads", implied_group='crm.group_use_lead')
     module_crm_voip = fields.Boolean("Asterisk (VoIP)")

addons/crm/wizard/base_partner_merge.py

@@ -233,8 +233,8 @@ class MergePartnerAutomatic(models.TransientModel):
             update_records('marketing.campaign.workitem', src=partner, field_model='object_id.model')
             update_records('ir.model.data', src=partner)
 
-        records = self.env['ir.model.fields'].search([('ttype', '=', 'reference')])
-        for record in records.sudo():
+        records = self.env['ir.model.fields'].sudo().search([('ttype', '=', 'reference')])
+        for record in records:
             try:
                 Model = self.env[record.model]
                 field = Model._fields[record.name]
@@ -250,7 +250,7 @@ class MergePartnerAutomatic(models.TransientModel):
                 values = {
                     record.name: 'res.partner,%d' % dst_partner.id,
                 }
-                records_ref.sudo().write(values)
+                records_ref.write(values)
 
     @api.model
     def _update_values(self, src_partners, dst_partner):

addons/google_account/models/google_service.py

@@ -57,11 +57,11 @@ class GoogleService(models.TransientModel):
 
     @api.model
     def _get_google_token_uri(self, service, scope):
-        Parameters = self.env['ir.config_parameter'].sudo()
+        get_param = self.env['ir.config_parameter'].sudo().get_param
         encoded_params = werkzeug.url_encode({
             'scope': scope,
-            'redirect_uri': Parameters.get_param('google_redirect_uri'),
-            'client_id': Parameters.get_param('google_%s_client_id' % service),
+            'redirect_uri': get_param('google_redirect_uri'),
+            'client_id': get_param('google_%s_client_id' % service),
             'response_type': 'code',
         })
         return '%s?%s' % (GOOGLE_AUTH_ENDPOINT, encoded_params)
@@ -77,9 +77,9 @@ class GoogleService(models.TransientModel):
             'f': from_url
         }
 
-        Parameters = self.env['ir.config_parameter']
-        base_url = Parameters.get_param('web.base.url', default='http://www.odoo.com?NoBaseUrl')
-        client_id = Parameters.sudo().get_param('google_%s_client_id' % (service,), default=False)
+        get_param = self.env['ir.config_parameter'].sudo().get_param
+        base_url = get_param('web.base.url', default='http://www.odoo.com?NoBaseUrl')
+        client_id = get_param('google_%s_client_id' % (service,), default=False)
 
         encoded_params = werkzeug.url_encode({
             'response_type': 'code',
@@ -97,10 +97,10 @@ class GoogleService(models.TransientModel):
         """ Call Google API to exchange authorization code against token, with POST request, to
             not be redirected.
         """
-        Parameters = self.env['ir.config_parameter']
-        base_url = Parameters.get_param('web.base.url', default='http://www.odoo.com?NoBaseUrl')
-        client_id = Parameters.sudo().get_param('google_%s_client_id' % (service,), default=False)
-        client_secret = Parameters.sudo().get_param('google_%s_client_secret' % (service,), default=False)
+        get_param = self.env['ir.config_parameter'].sudo().get_param
+        base_url = get_param('web.base.url', default='http://www.odoo.com?NoBaseUrl')
+        client_id = get_param('google_%s_client_id' % (service,), default=False)
+        client_secret = get_param('google_%s_client_secret' % (service,), default=False)
 
         headers = {"content-type": "application/x-www-form-urlencoded"}
         data = werkzeug.url_encode({
@@ -120,9 +120,9 @@ class GoogleService(models.TransientModel):
     # FIXME : this method update a field defined in google_calendar module. Since it is used only in that module, maybe it should be moved.
     @api.model
     def _refresh_google_token_json(self, refresh_token, service):  # exchange_AUTHORIZATION vs Token (service = calendar)
-        Parameters = self.env['ir.config_parameter'].sudo()
-        client_id = Parameters.get_param('google_%s_client_id' % (service,), default=False)
-        client_secret = Parameters.get_param('google_%s_client_secret' % (service,), default=False)
+        get_param = self.env['ir.config_parameter'].sudo().get_param
+        client_id = get_param('google_%s_client_id' % (service,), default=False)
+        client_secret = get_param('google_%s_client_secret' % (service,), default=False)
 
         headers = {"content-type": "application/x-www-form-urlencoded"}
         data = werkzeug.url_encode({

addons/google_calendar/models/google_calendar.py

@@ -906,14 +906,14 @@ class GoogleCalendar(models.AbstractModel):
         self.env.user.sudo().write(vals)
 
     def get_minTime(self):
-        number_of_week = self.env['ir.config_parameter'].get_param('calendar.week_synchro', default=13)
+        number_of_week = self.env['ir.config_parameter'].sudo().get_param('calendar.week_synchro', default=13)
         return datetime.now() - timedelta(weeks=number_of_week)
 
     def get_need_synchro_attendee(self):
-        return self.env['ir.config_parameter'].get_param('calendar.block_synchro_attendee', default=True)
+        return self.env['ir.config_parameter'].sudo().get_param('calendar.block_synchro_attendee', default=True)
 
     def get_disable_since_synchro(self):
-        return self.env['ir.config_parameter'].get_param('calendar.block_since_synchro', default=False)
+        return self.env['ir.config_parameter'].sudo().get_param('calendar.block_since_synchro', default=False)
 
     def get_print_log(self):
-        return self.env['ir.config_parameter'].get_param('calendar.debug_print', default=False)
+        return self.env['ir.config_parameter'].sudo().get_param('calendar.debug_print', default=False)

addons/google_calendar/models/res_config.py

@@ -14,11 +14,13 @@ class CalendarSettings(models.TransientModel):
     server_uri = fields.Char('URI for tuto')
 
     def set_calset(self):
-        self.env['ir.config_parameter'].set_param('google_calendar_client_id', (self.cal_client_id or '').strip(), groups=['base.group_system'])
-        self.env['ir.config_parameter'].set_param('google_calendar_client_secret', (self.cal_client_secret or '').strip(), groups=['base.group_system'])
+        set_param = self.env['ir.config_parameter'].set_param
+        set_param('google_calendar_client_id', (self.cal_client_id or '').strip())
+        set_param('google_calendar_client_secret', (self.cal_client_secret or '').strip())
 
     def get_default_all(self, fields):
-        cal_client_id = self.env['ir.config_parameter'].get_param('google_calendar_client_id', default='')
-        cal_client_secret = self.env['ir.config_parameter'].get_param('google_calendar_client_secret', default='')
-        server_uri = "%s/google_account/authentication" % self.env['ir.config_parameter'].get_param('web.base.url', default="http://yourcompany.odoo.com")
+        get_param = self.env['ir.config_parameter'].get_param
+        cal_client_id = get_param('google_calendar_client_id', default='')
+        cal_client_secret = get_param('google_calendar_client_secret', default='')
+        server_uri = "%s/google_account/authentication" % get_param('web.base.url', default="http://yourcompany.odoo.com")
         return dict(cal_client_id=cal_client_id, cal_client_secret=cal_client_secret, server_uri=server_uri)

addons/google_drive/data/google_drive_data.xml

@@ -5,13 +5,11 @@
          <record id="config_google_drive_client_id" model="ir.config_parameter">
             <field name="key">google_drive_client_id</field>
             <field name="value">598905559630.apps.googleusercontent.com</field>
-            <field name="group_ids" eval="[(4, ref('base.group_system'))]" />
         </record>
 
         <record id="config_google_drive_client_secret" model="ir.config_parameter">
             <field name="key">google_drive_client_secret</field>
             <field name="value">vTmou73c-njP-1qCxm7qx7QE</field>
-            <field name="group_ids" eval="[(4, ref('base.group_system'))]" />
         </record>
 
     </data>

addons/google_drive/models/google_drive.py

@@ -49,8 +49,8 @@ class GoogleDrive(models.Model):
 
     @api.model
     def get_access_token(self, scope=None):
-        Config = self.env['ir.config_parameter']
-        google_drive_refresh_token = Config.sudo().get_param('google_drive_refresh_token')
+        Config = self.env['ir.config_parameter'].sudo()
+        google_drive_refresh_token = Config.get_param('google_drive_refresh_token')
         user_is_admin = self.env['res.users'].browse(self.env.user.id)._is_admin()
         if not google_drive_refresh_token:
             if user_is_admin:
@@ -59,8 +59,8 @@ class GoogleDrive(models.Model):
                 raise RedirectWarning(msg, action_id, _('Go to the configuration panel'))
             else:
                 raise UserError(_("Google Drive is not yet configured. Please contact your administrator."))
-        google_drive_client_id = Config.sudo().get_param('google_drive_client_id')
-        google_drive_client_secret = Config.sudo().get_param('google_drive_client_secret')
+        google_drive_client_id = Config.get_param('google_drive_client_id')
+        google_drive_client_secret = Config.get_param('google_drive_client_secret')
         #For Getting New Access Token With help of old Refresh Token
         data = werkzeug.url_encode({
             'client_id': google_drive_client_id,

addons/google_drive/models/res_config.py

@@ -29,5 +29,5 @@ class BaseConfigSettings(models.TransientModel):
         if authorization_code and authorization_code != ICP.get_param('google_drive_authorization_code'):
             refresh_token = self.env['google.service'].generate_refresh_token('drive', authorization_code)
 
-        ICP.set_param('google_drive_authorization_code', authorization_code, groups=['base.group_system'])
-        ICP.set_param('google_drive_refresh_token', refresh_token, groups=['base.group_system'])
+        ICP.set_param('google_drive_authorization_code', authorization_code)
+        ICP.set_param('google_drive_refresh_token', refresh_token)

addons/google_spreadsheet/models/google_drive.py

@@ -40,7 +40,7 @@ class GoogleDrive(models.Model):
             formula = '=oe_read_group("%s";"%s";"%s";"%s")' % (model, fields, groupbys, domain)
         else:
             formula = '=oe_browse("%s";"%s";"%s")' % (model, fields, domain)
-        url = self.env['ir.config_parameter'].get_param('web.base.url')
+        url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         dbname = self._cr.dbname
         user = self.env['res.users'].browse(self.env.user.id).read(['login', 'password'])[0]
         username = user['login']

addons/hr_expense/models/res_config.py

@@ -7,7 +7,7 @@ class HrExpenseConfigSettings(models.TransientModel):
     _inherit = 'res.config.settings'
 
     alias_prefix = fields.Char('Default Alias Name for Expenses')
-    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
 
     @api.model
     def get_default_alias_prefix(self, fields):

addons/im_livechat/models/im_livechat_channel.py

@@ -195,7 +195,7 @@ class ImLivechatChannel(models.Model):
     def get_livechat_info(self, channel_id, username='Visitor'):
         info = {}
         info['available'] = len(self.browse(channel_id).get_available_users()) > 0
-        info['server_url'] = self.env['ir.config_parameter'].get_param('web.base.url')
+        info['server_url'] = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         if info['available']:
             info['options'] = self.sudo().get_channel_infos(channel_id)
             info['options']["default_username"] = username

addons/link_tracker/models/link_tracker.py

@@ -51,7 +51,7 @@ class link_tracker(models.Model):
     def convert_links(self, html, vals, blacklist=None):
         for match in re.findall(URL_REGEX, html):
 
-            short_schema = self.env['ir.config_parameter'].get_param('web.base.url') + '/r/'
+            short_schema = self.env['ir.config_parameter'].sudo().get_param('web.base.url') + '/r/'
 
             href = match[0]
             long_url = match[1]
@@ -76,12 +76,12 @@ class link_tracker(models.Model):
     @api.one
     @api.depends('code')
     def _compute_short_url(self):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         self.short_url = urljoin(base_url, '/r/%(code)s' % {'code': self.code})
 
     @api.one
     def _compute_short_url_host(self):
-        self.short_url_host = self.env['ir.config_parameter'].get_param('web.base.url') + '/r/'
+        self.short_url_host = self.env['ir.config_parameter'].sudo().get_param('web.base.url') + '/r/'
 
     @api.one
     def _compute_code(self):

addons/mail/models/mail_alias.py

@@ -63,7 +63,7 @@ class Alias(models.Model):
         help="Optional ID of a thread (record) to which all incoming messages will be attached, even "
              "if they did not reply to it. If set, this will disable the creation of new records completely.")
     alias_domain = fields.Char('Alias domain', compute='_get_alias_domain',
-                               default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+                               default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
     alias_parent_model_id = fields.Many2one(
         'ir.model', 'Parent Model',
         help="Parent model holding the alias. The model holding the alias reference "
@@ -86,7 +86,7 @@ class Alias(models.Model):
 
     @api.multi
     def _get_alias_domain(self):
-        alias_domain = self.env["ir.config_parameter"].get_param("mail.catchall.domain")
+        alias_domain = self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain")
         for record in self:
             record.alias_domain = alias_domain
 
@@ -111,10 +111,10 @@ class Alias(models.Model):
         if vals.get('alias_name'):
             vals['alias_name'] = self._clean_and_make_unique(vals.get('alias_name'))
         if model_name:
-            model = self.env['ir.model'].search([('model', '=', model_name)])
+            model = self.env['ir.model']._get(model_name)
             vals['alias_model_id'] = model.id
         if parent_model_name:
-            model = self.env['ir.model'].search([('model', '=', parent_model_name)])
+            model = self.env['ir.model']._get(parent_model_name)
             vals['alias_parent_model_id'] = model.id
         return super(Alias, self).create(vals)
 

addons/mail/models/mail_followers.py

@@ -40,7 +40,7 @@ class Followers(models.Model):
         :param force: if True, delete existing followers before creating new one
                       using the subtypes given in the parameters
         """
-        res_model_id = self.env['ir.model'].search([('model', '=', res_model)], limit=1).id
+        res_model_id = self.env['ir.model']._get(res_model).id
         force_mode = force or (all(data for data in partner_data.values()) and all(data for data in channel_data.values()))
         generic = []
         specific = {}

addons/mail/models/mail_mail.py

@@ -212,7 +212,7 @@ class MailMail(models.Model):
             try:
                 # TDE note: remove me when model_id field is present on mail.message - done here to avoid doing it multiple times in the sub method
                 if mail.model:
-                    model = self.env['ir.model'].sudo().search([('model', '=', mail.model)])[0]
+                    model = self.env['ir.model']._get(mail.model)[0]
                 else:
                     model = None
                 if model:
@@ -233,8 +233,9 @@ class MailMail(models.Model):
 
                 # headers
                 headers = {}
-                bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
-                catchall_domain = self.env['ir.config_parameter'].get_param("mail.catchall.domain")
+                ICP = self.env['ir.config_parameter'].sudo()
+                bounce_alias = ICP.get_param("mail.bounce.alias")
+                catchall_domain = ICP.get_param("mail.catchall.domain")
                 if bounce_alias and catchall_domain:
                     if mail.model and mail.res_id:
                         headers['Return-Path'] = '%s+%d-%s-%d@%s' % (bounce_alias, mail.id, mail.model, mail.res_id, catchall_domain)

addons/mail/models/mail_template.py

@@ -106,7 +106,7 @@ class MailTemplate(models.Model):
     def default_get(self, fields):
         res = super(MailTemplate, self).default_get(fields)
         if res.get('model'):
-            res['model_id'] = self.env['ir.model'].search([('model', '=', res.pop('model'))]).id
+            res['model_id'] = self.env['ir.model']._get(res.pop('model')).id
         return res
 
     name = fields.Char('Name')
@@ -201,9 +201,9 @@ class MailTemplate(models.Model):
     def onchange_sub_model_object_value_field(self):
         if self.model_object_field:
             if self.model_object_field.ttype in ['many2one', 'one2many', 'many2many']:
-                models = self.env['ir.model'].search([('model', '=', self.model_object_field.relation)])
-                if models:
-                    self.sub_object = models.id
+                model = self.env['ir.model']._get(self.model_object_field.relation)
+                if model:
+                    self.sub_object = model.id
                     self.copyvalue = self.build_expression(self.model_object_field.name, self.sub_model_object_field and self.sub_model_object_field.name or False, self.null_value or False)
             else:
                 self.sub_object = False
@@ -285,7 +285,7 @@ class MailTemplate(models.Model):
             html = '<div>%s</div>' % html
             root = lxml.html.fromstring(html)
 
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         (base_scheme, base_netloc, bpath, bparams, bquery, bfragment) = urlparse.urlparse(base_url)
 
         def _process_link(url):

addons/mail/models/mail_thread.py

@@ -229,7 +229,7 @@ class MailThread(models.AbstractModel):
 
         # automatic logging unless asked not to (mainly for various testing purpose)
         if not self._context.get('mail_create_nolog'):
-            doc_name = self.env['ir.model'].search([('model', '=', self._name)]).read(['name'])[0]['name']
+            doc_name = self.env['ir.model']._get(self._name).name
             thread.message_post(body=_('%s created') % doc_name)
 
         # auto_subscribe: take values and defaults into account
@@ -663,7 +663,7 @@ class MailThread(models.AbstractModel):
             access_link = self._notification_link_helper('view', message_id=message.id)
 
         if message.model:
-            model_name = self.env['ir.model'].sudo().search([('model', '=', self.env[message.model]._name)]).name_get()[0][1]
+            model_name = self.env['ir.model']._get(message.model).display_name
             view_title = '%s %s' % (_('View'), model_name)
         else:
             view_title = _('View')
@@ -745,7 +745,7 @@ class MailThread(models.AbstractModel):
         alias of the document, if it exists. Override this method to implement
         a custom behavior about reply-to for generated emails. """
         model_name = self.env.context.get('thread_model') or self._name
-        alias_domain = self.env['ir.config_parameter'].get_param("mail.catchall.domain")
+        alias_domain = self.env['ir.config_parameter'].sudo().get_param("mail.catchall.domain")
         res = dict.fromkeys(res_ids, False)
 
         # alias domain: check for aliases and catchall
@@ -768,7 +768,7 @@ class MailThread(models.AbstractModel):
             # left ids: use catchall
             left_ids = set(res_ids).difference(set(aliases.keys()))
             if left_ids:
-                catchall_alias = self.env['ir.config_parameter'].get_param("mail.catchall.alias")
+                catchall_alias = self.env['ir.config_parameter'].sudo().get_param("mail.catchall.alias")
                 if catchall_alias:
                     aliases.update(dict((res_id, '%s@%s' % (catchall_alias, alias_domain)) for res_id in left_ids))
             # compute name of reply-to
@@ -787,7 +787,7 @@ class MailThread(models.AbstractModel):
         """ Get specific notification email values to store on the notification
         mail_mail. Void method, inherit it to add custom values. """
         self.ensure_one()
-        database_uuid = self.env['ir.config_parameter'].get_param('database.uuid')
+        database_uuid = self.env['ir.config_parameter'].sudo().get_param('database.uuid')
         return {'headers': repr({
             'X-Odoo-Objects': "%s-%s" % (self._name, self.id),
             'X-Odoo-db-uuid': database_uuid
@@ -1012,7 +1012,7 @@ class MailThread(models.AbstractModel):
             raise TypeError('message must be an email.message.Message at this point')
         MailMessage = self.env['mail.message']
         Alias, dest_aliases = self.env['mail.alias'], self.env['mail.alias']
-        bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
+        bounce_alias = self.env['ir.config_parameter'].sudo().get_param("mail.bounce.alias")
         fallback_model = model
 
         # get email.message.Message variables for future processing
@@ -1133,7 +1133,7 @@ class MailThread(models.AbstractModel):
             dest_aliases = Alias.search([('alias_name', 'in', rcpt_tos_localparts)])
             if dest_aliases:
                 routes = []
-                for alias in dest_aliases:
+                for alias in dest_aliases.sudo():
                     user_id = alias.alias_user_id.id
                     if not user_id:
                         # TDE note: this could cause crashes, because no clue that the user

addons/mail/models/res_partner.py

@@ -65,7 +65,7 @@ class Partner(models.Model):
 
         model_name = False
         if message.model:
-            model_name = self.env['ir.model'].sudo().search([('model', '=', self.env[message.model]._name)]).name_get()[0][1]
+            model_name = self.env['ir.model']._get(message.model).display_name
 
         record_name = message.record_name
 

addons/mail/models/update.py

@@ -113,9 +113,10 @@ class PublisherWarrantyContract(AbstractModel):
                     pass
             if result.get('enterprise_info'):
                 # Update expiration date
-                self.env['ir.config_parameter'].sudo().set_param('database.expiration_date', result['enterprise_info'].get('expiration_date'), ['base.group_user'])
-                self.env['ir.config_parameter'].sudo().set_param('database.expiration_reason', result['enterprise_info'].get('expiration_reason', 'trial'), ['base.group_system'])
-                self.env['ir.config_parameter'].sudo().set_param('database.enterprise_code', result['enterprise_info'].get('enterprise_code'), ['base.group_user'])
+                set_param = self.env['ir.config_parameter'].sudo().set_param
+                set_param('database.expiration_date', result['enterprise_info'].get('expiration_date'))
+                set_param('database.expiration_reason', result['enterprise_info'].get('expiration_reason', 'trial'))
+                set_param('database.enterprise_code', result['enterprise_info'].get('enterprise_code'))
 
         except Exception:
             if cron_mode:

addons/mail/tests/test_mail_followers.py

@@ -25,7 +25,7 @@ class TestMailFollowers(TestMail):
             'mail.channel', groups.ids,
             {self.user_employee.partner_id.id: [self.mt_mg_nodef.id]},
             {test_channel.id: [self.mt_al_nodef.id]})
-        mail_channel_model_id = self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1).id
+        mail_channel_model_id = self.env['ir.model']._get('mail.channel').id
         self.assertFalse(specific)
         self.assertEqual(len(generic), 2)
 
@@ -40,7 +40,7 @@ class TestMailFollowers(TestMail):
 
     def test_m2o_command_update_selective(self):
         test_channel = self.env['mail.channel'].create({'name': 'Test'})
-        mail_channel_model_id = self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1).id
+        mail_channel_model_id = self.env['ir.model']._get('mail.channel').id
         groups = self.group_pigs | self.group_public
         self.env['mail.followers'].create({'partner_id': self.user_employee.partner_id.id, 'res_model_id': mail_channel_model_id, 'res_id': self.group_pigs.id})
         generic, specific = self.env['mail.followers']._add_follower_command(
@@ -136,7 +136,7 @@ class TestMailFollowers(TestMail):
         })
         with self.assertRaises(IntegrityError):
             self.env['mail.followers'].create({
-                'res_model_id': self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1).id,
+                'res_model_id': self.env['ir.model']._get('mail.channel').id,
                 'res_id': test_channel.id,
                 'partner_id': self.user_employee.partner_id.id,
                 'channel_id': self.group_pigs.id,

addons/mail/tests/test_mail_gateway.py

@@ -291,7 +291,7 @@ class TestMailgateway(TestMail):
     def setUp(self):
         super(TestMailgateway, self).setUp()
         # groups@.. will cause the creation of new mail.channels
-        self.mail_channel_model = self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1)
+        self.mail_channel_model = self.env['ir.model']._get('mail.channel')
         self.alias = self.env['mail.alias'].create({
             'alias_name': 'groups',
             'alias_user_id': False,
@@ -299,7 +299,7 @@ class TestMailgateway(TestMail):
             'alias_contact': 'everyone'})
 
         # test@.. will cause the creation of new mail.test
-        self.mail_test_model = self.env['ir.model'].search([('model', '=', 'mail.test')], limit=1)
+        self.mail_test_model = self.env['ir.model']._get('mail.test')
         self.alias_2 = self.env['mail.alias'].create({
             'alias_name': 'test',
             'alias_user_id': False,

addons/mail/tests/test_mail_template.py

@@ -32,7 +32,7 @@ class TestMailTemplate(TestMail):
         self.email_2 = 'test2@example.com'
         self.email_3 = self.partner_1.email
         self.email_template = self.env['mail.template'].create({
-            'model_id': self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1).id,
+            'model_id': self.env['ir.model']._get('mail.channel').id,
             'name': 'Pigs Template',
             'subject': '${object.name}',
             'body_html': '${object.description}',

addons/mail/wizard/invite.py

@@ -18,7 +18,7 @@ class Invite(models.TransientModel):
         if self._context.get('mail_invite_follower_channel_only'):
             result['send_mail'] = False
         if 'message' in fields and model and res_id:
-            model_name = self.env['ir.model'].search([('model', '=', model)]).name_get()[0][1]
+            model_name = self.env['ir.model']._get(model).display_name
             document_name = self.env[model].browse(res_id).name_get()[0][1]
             message = _('<div><p>Hello,</p><p>%s invited you to follow %s document: %s.</p></div>') % (user_name, model_name, document_name)
             result['message'] = message
@@ -46,8 +46,7 @@ class Invite(models.TransientModel):
             new_channels = wizard.channel_ids - document.message_channel_ids
             document.message_subscribe(new_partners.ids, new_channels.ids)
 
-            model_ids = self.env['ir.model'].search([('model', '=', wizard.res_model)])
-            model_name = model_ids.name_get()[0][1]
+            model_name = self.env['ir.model']._get(wizard.res_model).display_name
             # send an email if option checked and if a message exists (do not send void emails)
             if wizard.send_mail and wizard.message and not wizard.message == '<br>':  # when deleting the message, cleditor keeps a <br>
                 message = self.env['mail.message'].create({

addons/mail/wizard/mail_compose_message.py

@@ -392,16 +392,14 @@ class MailComposer(models.TransientModel):
         """ hit save as template button: current form value will be a new
             template attached to the current document. """
         for record in self:
-            models = self.env['ir.model'].search([('model', '=', record.model or 'mail.message')])
-            model_name = ''
-            if models:
-                model_name = models.name
+            model = self.env['ir.model']._get(record.model or 'mail.message')
+            model_name = model.name or ''
             template_name = "%s: %s" % (model_name, tools.ustr(record.subject))
             values = {
                 'name': template_name,
                 'subject': record.subject or False,
                 'body_html': record.body or False,
-                'model_id': models.id or False,
+                'model_id': model.id or False,
                 'attachment_ids': [(6, 0, [att.id for att in record.attachment_ids])],
             }
             template = self.env['mail.template'].create(values)

addons/marketing_campaign/models/ir_actions.py

@@ -11,6 +11,6 @@ class IrActionsReportXml(models.Model):
     def search(self, args, offset=0, limit=None, order=None, count=False):
         model_id = self.env.context.get('object_id')
         if model_id:
-            model = self.env['ir.model'].browse(model_id).model
+            model = self.env['ir.model'].browse(model_id).sudo().model
             args.append(('model', '=', model))
         return super(IrActionsReportXml, self).search(args, offset=offset, limit=limit, order=order, count=count)

addons/marketing_campaign/models/marketing_campaign.py

@@ -291,7 +291,7 @@ class MarketingCampaignActivity(models.Model):
 
     name = fields.Char('Name', required=True)
     campaign_id = fields.Many2one('marketing.campaign', 'Campaign', required=True, ondelete='cascade', index=True)
-    object_id = fields.Many2one(related='campaign_id.object_id', relation='ir.model', string='Object', readonly=True)
+    object_id = fields.Many2one('ir.model', related='campaign_id.object_id', string='Object', readonly=True)
     start = fields.Boolean('Start', help="This activity is launched when the campaign starts.", index=True)
     condition = fields.Text('Condition', required=True, default="True",
         help="Python expression to decide whether the activity can be executed, otherwise it will be deleted or cancelled."

addons/mass_mailing/models/mail_mail.py

@@ -29,7 +29,7 @@ class MailMail(models.Model):
         return mail
 
     def _get_tracking_url(self, partner=None):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         track_url = urlparse.urljoin(
             base_url, 'mail/track/%(mail_id)s/blank.gif?%(params)s' % {
                 'mail_id': self.id,
@@ -39,7 +39,7 @@ class MailMail(models.Model):
         return '<img src="%s" alt=""/>' % track_url
 
     def _get_unsubscribe_url(self, email_to):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         url = urlparse.urljoin(
             base_url, 'mail/mailing/%(mailing_id)s/unsubscribe?%(params)s' % {
                 'mailing_id': self.mailing_id.id,
@@ -75,7 +75,7 @@ class MailMail(models.Model):
                     body = body.replace(href, new_href)
 
         # prepend <base> tag for images using absolute urls
-        domain = self.env["ir.config_parameter"].get_param("web.base.url")
+        domain = self.env["ir.config_parameter"].sudo().get_param("web.base.url")
         base = "<base href='%s'>" % domain
         body = tools.append_content_to_html(base, body, plaintext=False, container_tag='div')
         # resolve relative image url to absolute for outlook.com
@@ -95,7 +95,7 @@ class MailMail(models.Model):
     def send_get_email_dict(self, partner=None):
         # TDE: temporary addition (mail was parameter) due to semi-new-API
         res = super(MailMail, self).send_get_email_dict(partner)
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         if self.mailing_id and res.get('body') and res.get('email_to'):
             emails = tools.email_split(res.get('email_to')[0])
             email_to = emails and emails[0] or False

addons/mass_mailing/models/mail_thread.py

@@ -17,7 +17,7 @@ class MailThread(models.AbstractModel):
     @api.model
     def message_route(self, message, message_dict, model=None, thread_id=None, custom_values=None):
         """ Override to udpate mass mailing statistics based on bounce emails """
-        bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
+        bounce_alias = self.env['ir.config_parameter'].sudo().get_param("mail.bounce.alias")
         email_to = decode_message_header(message, 'To')
         email_to_localpart = (tools.email_split(email_to) or [''])[0].split('@', 1)[0].lower()
 

addons/payment_adyen/models/payment.py

@@ -109,7 +109,7 @@ class AcquirerAdyen(models.Model):
 
     @api.multi
     def adyen_form_generate_values(self, values):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         # tmp
         import datetime
         from dateutil import relativedelta

addons/payment_authorize/controllers/main.py

@@ -24,7 +24,7 @@ class AuthorizeController(http.Controller):
         if post:
             request.env['payment.transaction'].sudo().form_feedback(post, 'authorize')
             return_url = post.pop('return_url', '/')
-        base_url = request.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = request.env['ir.config_parameter'].sudo().get_param('web.base.url')
         # Authorize.Net is expecting a response to the POST sent by their server.
         # This response is in the form of a URL that Authorize.Net will pass on to the
         # client's browser to redirect them to the desired location need javascript.

addons/payment_buckaroo/models/payment.py

@@ -85,7 +85,7 @@ class AcquirerBuckaroo(models.Model):
 
     @api.multi
     def buckaroo_form_generate_values(self, values):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         buckaroo_tx_values = dict(values)
         buckaroo_tx_values.update({
             'Brq_websitekey': self.brq_websitekey,

addons/payment_ogone/models/payment.py

@@ -150,7 +150,7 @@ class PaymentAcquirerOgone(models.Model):
         return shasign
 
     def ogone_form_generate_values(self, values):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         ogone_tx_values = dict(values)
         temp_ogone_tx_values = {
             'PSPID': self.ogone_pspid,

addons/payment_payumoney/models/payment.py

@@ -54,7 +54,7 @@ class PaymentAcquirerPayumoney(models.Model):
     @api.multi
     def payumoney_form_generate_values(self, values):
         self.ensure_one()
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         payumoney_values = dict(values,
                                 key=self.payumoney_merchant_key,
                                 txnid=values['reference'],

addons/point_of_sale/models/pos_session.py

@@ -249,7 +249,7 @@ class PosSession(models.Model):
             for st in session.statement_ids:
                 if abs(st.difference) > st.journal_id.amount_authorized_diff:
                     # The pos manager can close statements with maximums.
-                    if not self.env['ir.model.access'].check_groups("point_of_sale.group_pos_manager"):
+                    if not self.user_has_groups("point_of_sale.group_pos_manager"):
                         raise UserError(_("Your ending balance is too different from the theoretical cash closing (%.2f), the maximum allowed is: %.2f. You can contact your manager to force it.") % (st.difference, st.journal_id.amount_authorized_diff))
                 if (st.journal_id.type not in ['bank', 'cash']):
                     raise UserError(_("The type of the journal for your payment method should be bank or cash "))

addons/product/models/res_company.py

@@ -17,7 +17,7 @@ class ResCompany(models.Model):
                 'name': new_company.name,
                 'currency_id': new_company.currency_id.id,
             })
-        field = self.env['ir.model.fields'].search([('model', '=', 'res.partner'), ('name', '=', 'property_product_pricelist')])
+        field = self.env['ir.model.fields']._get('res.partner', 'property_product_pricelist')
         self.env['ir.property'].create({
             'name': 'property_product_pricelist',
             'company_id': new_company.id,

addons/project/models/project.py

@@ -257,9 +257,7 @@ class Project(models.Model):
     def write(self, vals):
         # if alias_model has been changed, update alias_model_id accordingly
         if vals.get('alias_model'):
-            vals['alias_model_id'] = self.env['ir.model'].search([
-                ('model', '=', vals.get('alias_model', 'project.task'))
-            ], limit=1).id
+            vals['alias_model_id'] = self.env['ir.model']._get(vals.get('alias_model', 'project.task')).id
         res = super(Project, self).write(vals)
         if 'active' in vals:
             # archiving/unarchiving a project does it on its tasks, too

addons/report/models/report.py

@@ -115,7 +115,7 @@ class Report(models.Model):
             user=user,
             res_company=user.company_id,
             website=website,
-            web_base_url=self.env['ir.config_parameter'].get_param('web.base.url', default='')
+            web_base_url=self.env['ir.config_parameter'].sudo().get_param('web.base.url', default='')
         )
         return view_obj.render_template(template, values)
 

addons/sale/security/ir.model.access.csv

@@ -20,8 +20,6 @@ access_res_partner_sale_manager,res.partner.sale.manager,base.model_res_partner,
 access_product_template_sale_user,product.template sale use,product.model_product_template,sales_team.group_sale_salesman,1,0,0,0
 access_product_product_sale_user,product.product sale use,product.model_product_product,sales_team.group_sale_salesman,1,0,0,0
 access_account_tax_user,account.tax.user,account.model_account_tax,sales_team.group_sale_salesman,1,0,0,0
-access_ir_attachment_sales,ir.attachment.sales,base.model_ir_attachment,sales_team.group_sale_salesman,1,1,1,0
-access_ir_attachment_manager,ir.attachment.manager,base.model_ir_attachment,sales_team.group_sale_manager,1,1,1,1
 access_product_uom_user,product.uom.user,product.model_product_uom,sales_team.group_sale_salesman,1,0,0,0
 access_product_pricelist_sale_user,product.pricelist.sale.user,product.model_product_pricelist,sales_team.group_sale_salesman,1,0,0,0
 access_account_account_salesman,account_account salesman,account.model_account_account,sales_team.group_sale_salesman,1,0,0,0

addons/stock_account/models/account_chart_template.py

@@ -21,7 +21,7 @@ class AccountChartTemplate(models.Model):
         PropertyObj = self.env['ir.property']  # Property Stock Journal
         value = self.env['account.journal'].search([('company_id', '=', company.id), ('code', '=', 'STJ'), ('type', '=', 'general')], limit=1)
         if value:
-            field = self.env['ir.model.fields'].search([('name', '=', 'property_stock_journal'), ('model', '=', 'product.category'), ('relation', '=', 'account.journal')], limit=1)
+            field = self.env['ir.model.fields'].sudo().search([('name', '=', 'property_stock_journal'), ('model', '=', 'product.category'), ('relation', '=', 'account.journal')])
             vals = {
                 'name': 'property_stock_journal',
                 'company_id': company.id,
@@ -45,7 +45,7 @@ class AccountChartTemplate(models.Model):
             account = getattr(self, record)
             value = account and 'account.account,' + str(acc_template_ref[account.id]) or False
             if value:
-                field = self.env['ir.model.fields'].search([('name', '=', record), ('model', '=', 'product.category'), ('relation', '=', 'account.account')], limit=1)
+                field = self.env['ir.model.fields'].sudo().search([('name', '=', record), ('model', '=', 'product.category'), ('relation', '=', 'account.account')])
                 vals = {
                     'name': record,
                     'company_id': company.id,

addons/survey/models/survey.py

@@ -104,7 +104,8 @@ class Survey(models.Model):
 
     def _compute_survey_url(self):
         """ Computes a public URL for the survey """
-        base_url = '/' if self.env.context.get('relative_url') else self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = '/' if self.env.context.get('relative_url') else \
+                   self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for survey in self:
             survey.public_url = urljoin(base_url, "survey/start/%s" % (slug(survey)))
             survey.print_url = urljoin(base_url, "survey/print/%s" % (slug(survey)))

addons/web/controllers/main.py

@@ -18,6 +18,7 @@ import os
 import re
 import sys
 import time
+import werkzeug
 import werkzeug.utils
 import werkzeug.wrappers
 import zlib
@@ -777,6 +778,17 @@ class Session(http.Controller):
         request.session.check_security()
         return None
 
+    @http.route('/web/session/account', type='json', auth="user")
+    def account(self):
+        ICP = request.env['ir.config_parameter'].sudo()
+        params = {
+            'response_type': 'token',
+            'client_id': ICP.get_param('database.uuid') or '',
+            'state': json.dumps({'d': request.db, 'u': ICP.get_param('web.base.url')}),
+            'scope': 'userinfo',
+        }
+        return 'https://accounts.odoo.com/oauth2/auth?' + werkzeug.url_encode(params)
+
     @http.route('/web/session/destroy', type='json', auth="user")
     def destroy(self):
         request.session.logout()

addons/web/static/src/js/widgets/user_menu.js

@@ -58,21 +58,11 @@ var UserMenu = Widget.extend({
         });
     },
     on_menu_account: function() {
+        var self = this;
         this.trigger_up('clear_uncommitted_changes', {
             callback: function() {
-                var P = new Model('ir.config_parameter');
-                P.call('get_param', ['database.uuid']).then(function(dbuuid) {
-                    var state = {
-                        'd': session.db,
-                        'u': window.location.protocol + '//' + window.location.host,
-                    };
-                    var params = {
-                        response_type: 'token',
-                        client_id: dbuuid || '',
-                        state: JSON.stringify(state),
-                        scope: 'userinfo',
-                    };
-                    framework.redirect('https://accounts.odoo.com/oauth2/auth?'+$.param(params));
+                self.rpc('/web/session/account').then(function(url) {
+                    framework.redirect(url);
                 }).fail(function(result, ev){
                     ev.preventDefault();
                     framework.redirect('https://accounts.odoo.com/account');

addons/web_diagram/controllers/main.py

@@ -76,7 +76,7 @@ class DiagramView(http.Controller):
             for i, fld in enumerate(connector_fields):
                 t['options'][connector_fields_string[i]] = tr[fld]
 
-        fields = http.request.env['ir.model.fields']
+        fields = http.request.env['ir.model.fields'].sudo()
         field = fields.search([('model', '=', model), ('relation', '=', node)])
         node_act = http.request.env[node]
         search_acts = node_act.search([(field.relation_field, '=', id)])

addons/web_tour/models/ir_ui_menu.py

@@ -18,7 +18,7 @@ class IrUiMenu(models.Model):
         menu_ids = [menu.id for menu in self.browse(menu_root['all_menu_ids']) if menu.load_xmlid]
         xmlids = {
             d.res_id: d.module + "." + d.name
-            for d in self.env['ir.model.data'].search([('res_id', 'in', menu_ids), ('model', '=', 'ir.ui.menu')])
+            for d in self.env['ir.model.data'].sudo().search([('res_id', 'in', menu_ids), ('model', '=', 'ir.ui.menu')])
         }
 
         def _find_subtree(tree, node_id):

addons/website/models/ir_actions.py

@@ -28,7 +28,7 @@ class ServerAction(models.Model):
             action.xml_id = res.get(action.id)
 
     def _compute_website_url(self, website_path, xml_id):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         link = website_path or xml_id or (self.id and '%d' % self.id) or ''
         if base_url and link:
             path = '%s/%s' % ('/website/action', link)

addons/website/models/res_config.py

@@ -59,8 +59,7 @@ class WebsiteConfigSettings(models.TransientModel):
         return dict(google_maps_api_key=google_maps_api_key)
 
     def set_google_maps_api_key(self):
-        self.env['ir.config_parameter'].set_param(
-            'google_maps_api_key', (self.google_maps_api_key or '').strip(), groups=['base.group_system'])
+        self.env['ir.config_parameter'].set_param('google_maps_api_key', (self.google_maps_api_key or '').strip())
 
     @api.depends('language_ids')
     def _compute_language_count(self):

addons/website_blog/controllers/main.py

@@ -172,7 +172,7 @@ class WebsiteBlog(http.Controller):
     def blog_feed(self, blog, limit='15'):
         v = {}
         v['blog'] = blog
-        v['base_url'] = request.env['ir.config_parameter'].get_param('web.base.url')
+        v['base_url'] = request.env['ir.config_parameter'].sudo().get_param('web.base.url')
         v['posts'] = request.env['blog.post'].search([('blog_id','=', blog.id)], limit=min(int(limit), 50))
         r = request.render("website_blog.blog_feed", v, headers=[('Content-Type', 'application/atom+xml')])
         return r

addons/website_blog/models/website_blog.py

@@ -194,7 +194,7 @@ class BlogPost(models.Model):
                     'website_blog.blog_post_template_new_post',
                     subject=post.name,
                     values={'post': post},
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_blog.mt_blog_blog_published'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_blog.mt_blog_blog_published'))
             return True
         return False
 

addons/website_crm_partner_assign/__manifest__.py

@@ -14,9 +14,9 @@ Publish and Assign Partner
     'depends': ['base_geolocalize', 'crm', 'account', 'portal',
                 'website_partner', 'website_google_map', 'website_portal'],
     'data': [
-        'data/portal_data.xml',
-        'data/crm_partner_assign_data.xml',
         'security/ir.model.access.csv',
+        'security/ir_rule.xml',
+        'data/crm_partner_assign_data.xml',
         'wizard/crm_forward_to_partner_view.xml',
         'views/res_partner_views.xml',
         'views/crm_lead_views.xml',

addons/website_crm_partner_assign/data/portal_data.xml

@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<odoo>
-        <!-- Partner and address -->
-        <record id="res_partner_grade_access" model="ir.model.access">
-            <field name="name">odoo.portal.res.partner.grade</field>
-            <field name="model_id" ref="website_crm_partner_assign.model_res_partner_grade"/>
-            <field name="group_id" ref="base.group_portal"/>
-            <field name="perm_read" eval="1"/>
-            <field name="perm_create" eval="0"/>
-            <field name="perm_write" eval="0"/>
-            <field name="perm_unlink" eval="0"/>
-        </record>
-
-        <!-- CRM Lead portal -->
-        <record id="assigned_lead_portal_rule_1" model="ir.rule">
-            <field name="name">odoo.portal.crm.lead</field>
-            <field name="model_id" ref="crm.model_crm_lead"/>
-            <field name="groups" eval="[(6,0,[ref('base.group_portal')])]"/>
-            <field name="domain_force">[('partner_assigned_id','child_of',user.commercial_partner_id.id)]</field>
-        </record>
-        <record id="lead_portal_access" model="ir.model.access">
-            <field name="name">odoo.portal.crm.lead</field>
-            <field name="model_id" ref="crm.model_crm_lead"/>
-            <field name="group_id" ref="base.group_portal"/>
-            <field name="perm_read" eval="1"/>
-            <field name="perm_create" eval="0"/>
-            <field name="perm_write" eval="1"/>
-            <field name="perm_unlink" eval="0"/>
-        </record>
-</odoo>

addons/website_crm_partner_assign/security/ir.model.access.csv

@@ -11,6 +11,4 @@ access_res_partner_activation_user,res.partner.activation.user,model_res_partner
 access_partner_activation_manager,res.partner.activation.manager,model_res_partner_activation,base.group_partner_manager,1,1,1,1
 partner_access_crm_lead,crm.lead,crm.model_crm_lead,base.group_portal,1,1,0,0
 access_res_partner_grade_invoicing_payment,res.partner.grade,model_res_partner_grade,account.group_account_invoice,1,0,0,0
-access_res_partner_grade_portal,res.partner.grade,model_res_partner_grade,base.group_portal,1,0,0,0
-crm_lead_portal_access,crm.lead.portal,crm.model_crm_lead,base.group_portal,1,1,0,0
-mail_message_subtype_portal_access,mail.message.subtype.portal,mail.model_mail_message_subtype,base.group_portal,1,1,1,0
+mail_message_subtype_portal_access,mail.message.subtype.portal,mail.model_mail_message_subtype,base.group_portal,1,1,1,0

addons/website_crm_partner_assign/security/ir_rule.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <!-- CRM Lead portal -->
+    <record id="assigned_lead_portal_rule_1" model="ir.rule">
+        <field name="name">odoo.portal.crm.lead</field>
+        <field name="model_id" ref="crm.model_crm_lead"/>
+        <field name="groups" eval="[(6,0,[ref('base.group_portal')])]"/>
+        <field name="domain_force">[('partner_assigned_id','child_of',user.commercial_partner_id.id)]</field>
+    </record>
+</odoo>

addons/website_crm_partner_assign/wizard/crm_forward_to_partner.py

@@ -107,14 +107,14 @@ class CrmLeadForwardToPartner(models.TransientModel):
         action = type == 'opportunity' and 'action_portal_opportunities' or 'action_portal_leads'
         action_ref = self.env.ref('website_crm_partner_assign.%s' % (action,), False)
         portal_link = "%s/?db=%s#id=%s&action=%s&view_type=form" % (
-            self.env['ir.config_parameter'].get_param('web.base.url'),
+            self.env['ir.config_parameter'].sudo().get_param('web.base.url'),
             self.env.cr.dbname,
             lead_id,
             action_ref and action_ref.id or False)
         return portal_link
 
     def get_portal_url(self):
-        portal_link = "%s/?db=%s" % (self.env['ir.config_parameter'].get_param('web.base.url'), self.env.cr.dbname)
+        portal_link = "%s/?db=%s" % (self.env['ir.config_parameter'].sudo().get_param('web.base.url'), self.env.cr.dbname)
         return portal_link
 
     forward_type = fields.Selection([

addons/website_event_track/models/website_event_track.py

@@ -68,7 +68,7 @@ class Track(models.Model):
         res.message_post_with_view(
             'website_event_track.event_track_template_new',
             subject=res.name,
-            subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_event_track.mt_event_track'))
+            subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_event_track.mt_event_track'))
         return res
 
     @api.multi

addons/website_form/controllers/main.py

@@ -21,7 +21,7 @@ class WebsiteForm(http.Controller):
     # Check and insert values from the form on the model <model>
     @http.route('/website_form/<string:model_name>', type='http', auth="public", methods=['POST'], website=True)
     def website_form(self, model_name, **kwargs):
-        model_record = request.env['ir.model'].search([('model', '=', model_name), ('website_form_access', '=', True)])
+        model_record = request.env['ir.model'].sudo().search([('model', '=', model_name), ('website_form_access', '=', True)])
         if not model_record:
             return json.dumps(False)
 

addons/website_form/models/models.py

@@ -41,13 +41,14 @@ class website_form_model(models.Model):
             ])
         }
         return {
-            k: v for k, v in self.get_authorized_fields().iteritems()
+            k: v for k, v in self.get_authorized_fields(self.model).iteritems()
             if k not in excluded
         }
 
-    @api.multi
-    def get_authorized_fields(self):
-        model = self.env[self.model]
+    @api.model
+    def get_authorized_fields(self, model_name):
+        """ Return the fields of the given model name as a mapping like method `fields_get`. """
+        model = self.env[model_name]
         fields_get = model.fields_get()
 
         for key, val in model._inherits.iteritems():

addons/website_forum/data/forum_data.xml

@@ -13,7 +13,7 @@
         </record>
     </data>
     <data>
-        <function model="ir.config_parameter" name="set_param" eval="('auth_signup.allow_uninvited', True)" />
+        <function model="ir.config_parameter" name="set_param" eval="('auth_signup.allow_uninvited', True)"/>
 
         <!-- JUMP TO FORUM AT INSTALL -->
         <record id="action_open_forum" model="ir.actions.act_url">

addons/website_forum/models/forum.py

@@ -33,7 +33,7 @@ class Forum(models.Model):
         TDE TODO: move me somewhere else, auto_init ? """
         forum_uuids = self.env['ir.config_parameter'].search([('key', '=', 'website_forum.uuid')])
         if not forum_uuids:
-            forum_uuids.set_param('website_forum.uuid', str(uuid.uuid4()), ['base.group_system'])
+            forum_uuids.set_param('website_forum.uuid', str(uuid.uuid4()))
 
     @api.model
     def _get_default_faq(self):
@@ -525,14 +525,14 @@ class Post(models.Model):
                     subject=_('Re: %s') % post.parent_id.name,
                     partner_ids=[(4, p.id) for p in tag_partners],
                     channel_ids=[(4, c.id) for c in tag_channels],
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_forum.mt_answer_new'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_forum.mt_answer_new'))
             elif post.state == 'active' and not post.parent_id:
                 post.message_post_with_view(
                     'website_forum.forum_post_template_new_question',
                     subject=post.name,
                     partner_ids=[(4, p.id) for p in tag_partners],
                     channel_ids=[(4, c.id) for c in tag_channels],
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_forum.mt_question_new'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_forum.mt_question_new'))
             elif post.state == 'pending' and not post.parent_id:
                 # TDE FIXME: in master, you should probably use a subtype;
                 # however here we remove subtype but set partner_ids
@@ -543,7 +543,7 @@ class Post(models.Model):
                     'website_forum.forum_post_template_validation',
                     subject=post.name,
                     partner_ids=partners.ids,
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('mail.mt_note'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('mail.mt_note'))
         return True
 
     @api.multi

addons/website_forum/models/res_users.py

@@ -84,7 +84,7 @@ class Users(models.Model):
                 'email': self.email}
             if forum_id:
                 params['forum_id'] = forum_id
-            base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+            base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
             token_url = base_url + '/forum/validate_email?%s' % urlencode(params)
             activation_template.sudo().with_context(token_url=token_url).send_mail(self.id, force_send=True)
         return True

addons/website_hr_recruitment/models/hr_recruitment.py

@@ -17,7 +17,7 @@ class RecruitmentSource(models.Model):
     @api.one
     @api.depends('source_id', 'source_id.name', 'job_id')
     def _compute_url(self):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for source in self:
             source.url = urljoin(base_url, "%s?%s" % (source.job_id.website_url,
                 url_encode({

addons/website_mail_channel/models/mail_channel.py

@@ -17,7 +17,7 @@ class MailGroup(models.Model):
     def message_get_email_values(self, notif_mail=None):
         self.ensure_one()
         res = super(MailGroup, self).message_get_email_values(notif_mail=notif_mail)
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         headers = {}
         if res.get('headers'):
             try:

addons/website_mail_channel/models/mail_mail.py

@@ -15,7 +15,7 @@ class MailMail(models.Model):
         if self.model == 'mail.channel' and self.res_id:
             # no super() call on purpose, no private links that could be quoted!
             channel = self.env['mail.channel'].browse(self.res_id)
-            base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+            base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
             vals = {
                 'maillist': _('Mailing-List'),
                 'post_to': _('Post to'),

addons/website_sale/controllers/main.py

@@ -507,7 +507,7 @@ class WebsiteSale(http.Controller):
 
     def values_postprocess(self, order, mode, values, errors, error_msg):
         new_values = {}
-        authorized_fields = request.env['ir.model'].sudo().search([('model', '=', 'res.partner')])._get_form_writable_fields()
+        authorized_fields = request.env['ir.model']._get('res.partner')._get_form_writable_fields()
         for k, v in values.items():
             # don't drop empty value, it could be a field to reset
             if k in authorized_fields and v is not None:

addons/website_slides/controllers/main.py

@@ -333,7 +333,7 @@ class WebsiteSlides(http.Controller):
 
         # determine if it is embedded from external web page
         referrer_url = request.httprequest.headers.get('Referer', '')
-        base_url = request.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = request.env['ir.config_parameter'].sudo().get_param('web.base.url')
         is_embedded = referrer_url and not bool(base_url in referrer_url) or False
         # try accessing slide, and display to corresponding template
         try:

addons/website_slides/data/website_slides_data.xml

@@ -5,7 +5,6 @@
         <record model="ir.config_parameter" id="google_app_key">
             <field name="key">website_slides.google_app_key</field>
             <field name="value">AIzaSyDOWlmDW-7DbLmOR9ZsT5AOEXf4n6TFwQA</field>
-            <field name="group_ids" eval="[(4, ref('base.group_system'))]" />
         </record>
 
         <record id="website_menu_slides" model="website.menu">

addons/website_slides/models/slides.py

@@ -146,7 +146,7 @@ class Channel(models.Model):
     @api.depends('name')
     def _compute_website_url(self):
         super(Channel, self)._compute_website_url()
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for channel in self:
             if channel.id:  # avoid to perform a slug on a not yet saved record in case of an onchange.
                 channel.website_url = '%s/slides/%s' % (base_url, slug(channel))
@@ -347,7 +347,7 @@ class Slide(models.Model):
     embed_code = fields.Text('Embed Code', readonly=True, compute='_get_embed_code')
 
     def _get_embed_code(self):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for record in self:
             if record.datas and (not record.document_id or record.slide_type in ['document', 'presentation']):
                 record.embed_code = '<iframe src="%s/slides/embed/%s?page=1" allowFullScreen="true" height="%s" width="%s" frameborder="0"></iframe>' % (base_url, record.id, 315, 420)
@@ -365,7 +365,7 @@ class Slide(models.Model):
     @api.depends('name')
     def _compute_website_url(self):
         super(Slide, self)._compute_website_url()
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for slide in self:
             if slide.id:  # avoid to perform a slug on a not yet saved record in case of an onchange.
                 # link_tracker is not in dependencies, so use it to shorten url only if installed.
@@ -473,7 +473,7 @@ class Slide(models.Model):
             yield record
 
     def _post_publication(self):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for slide in self.filtered(lambda slide: slide.website_published and slide.channel_id.publish_template_id):
             publish_template = slide.channel_id.publish_template_id
             html_body = publish_template.with_context({'base_url': base_url}).render_template(publish_template.body_html, 'slide.slide', slide.id)
@@ -486,7 +486,7 @@ class Slide(models.Model):
 
     @api.one
     def send_share_email(self, email):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         return self.channel_id.share_template_id.with_context({'email': email, 'base_url': base_url}).send_mail(self.id)
 
     # --------------------------------------------------

odoo/addons/base/__init__.py

@@ -10,11 +10,6 @@ import tests
 def post_init(cr, registry):
     """Rewrite ICP's to force groups"""
     from odoo import api, SUPERUSER_ID
-    from odoo.addons.base.ir.ir_config_parameter import _default_parameters
 
     env = api.Environment(cr, SUPERUSER_ID, {})
-    ICP = env['ir.config_parameter']
-    for key, func in _default_parameters.iteritems():
-        val = ICP.get_param(key)
-        _, groups = func()
-        ICP.set_param(key, val, groups)
+    env['ir.config_parameter'].init(force=True)

odoo/addons/base/ir/ir_actions.py

@@ -470,7 +470,7 @@ class IrActionsServer(models.Model):
     name = fields.Char(string='Action Name', translate=True)
     type = fields.Char(default='ir.actions.server')
 
-    condition = fields.Char(default="True",
+    condition = fields.Char(default="True", groups='base.group_system',
                             help="Condition verified before executing the server action. If it "
                                  "is not verified, the action will not be executed. The condition is "
                                  "a Python expression, like 'record.list_price > 5000'. A void "
@@ -498,7 +498,7 @@ class IrActionsServer(models.Model):
     action_id = fields.Many2one('ir.actions.actions', string='Client Action',
                                 help="Select the client action that has to be executed.")
     # Python code
-    code = fields.Text(string='Python Code',
+    code = fields.Text(string='Python Code', groups='base.group_system',
                        default=DEFAULT_PYTHON_CODE,
                        help="Write Python code that the action will execute. Some variables are "
                             "available for use; help about pyhon expression is given in the help tab.")
@@ -580,7 +580,7 @@ class IrActionsServer(models.Model):
 
     @api.constrains('code')
     def _check_python_code(self):
-        for action in self.filtered('code'):
+        for action in self.sudo().filtered('code'):
             msg = test_python_expr(expr=action.code.strip(), mode="exec")
             if msg:
                 raise ValidationError(msg)
@@ -756,7 +756,7 @@ class IrActionsServer(models.Model):
 
     @api.model
     def run_action_code_multi(self, action, eval_context=None):
-        safe_eval(action.code.strip(), eval_context, mode="exec", nocopy=True)  # nocopy allows to return 'action'
+        safe_eval(action.sudo().code.strip(), eval_context, mode="exec", nocopy=True)  # nocopy allows to return 'action'
         if 'action' in eval_context:
             return eval_context['action']
 
@@ -894,7 +894,7 @@ class IrActionsServer(models.Model):
         """
         for action in self:
             eval_context = self._get_eval_context(action)
-            condition = action.condition
+            condition = action.sudo().condition
             if condition is False:
                 # Void (aka False) conditions are considered as True
                 condition = True

odoo/addons/base/ir/ir_config_parameter.py

@@ -16,10 +16,10 @@ _logger = logging.getLogger(__name__)
 A dictionary holding some configuration parameters to be initialized when the database is created.
 """
 _default_parameters = {
-    "database.secret": lambda: (str(uuid.uuid4()), ['base.group_erp_manager']),
-    "database.uuid": lambda: (str(uuid.uuid1()), []),
-    "database.create_date": lambda: (fields.Datetime.now(), ['base.group_user']),
-    "web.base.url": lambda: ("http://localhost:%s" % config.get('xmlrpc_port'), []),
+    "database.secret": lambda: str(uuid.uuid4()),
+    "database.uuid": lambda: str(uuid.uuid1()),
+    "database.create_date": fields.Datetime.now,
+    "web.base.url": lambda: "http://localhost:%s" % config.get('xmlrpc_port'),
 }
 
 
@@ -30,7 +30,6 @@ class IrConfigParameter(models.Model):
 
     key = fields.Char(required=True, index=True)
     value = fields.Text(required=True)
-    group_ids = fields.Many2many('res.groups', 'ir_config_parameter_groups_rel', 'icp_id', 'group_id', string='Groups')
 
     _sql_constraints = [
         ('key_uniq', 'unique (key)', 'Key must be unique.')
@@ -47,8 +46,7 @@ class IrConfigParameter(models.Model):
             # force=True skips search and always performs the 'if' body (because ids=False)
             params = self.sudo().search([('key', '=', key)])
             if force or not params:
-                value, groups = func()
-                params.set_param(key, value, groups=groups)
+                params.set_param(key, func())
 
     @api.model
     def get_param(self, key, default=False):
@@ -68,43 +66,33 @@ class IrConfigParameter(models.Model):
         return params[0]['value'] if params else None
 
     @api.model
-    def set_param(self, key, value, groups=()):
+    def set_param(self, key, value):
         """Sets the value of a parameter.
 
         :param string key: The key of the parameter value to set.
         :param string value: The value to set.
-        :param list of string groups: List of group (xml_id allowed) to read this key.
         :return: the previous value of the parameter or False if it did
                  not exist.
         :rtype: string
         """
-        self._get_param.clear_cache(self)
         param = self.search([('key', '=', key)])
-
-        gids = []
-        for group_xml in groups:
-            group = self.env.ref(group_xml, raise_if_not_found=False)
-            if group:
-                gids.append((4, group.id))
-            else:
-                _logger.warning('Potential Security Issue: Group [%s] is not found.' % group_xml)
-
-        vals = {'value': value}
-        if gids:
-            vals.update(group_ids=gids)
         if param:
             old = param.value
             if value is not False and value is not None:
-                param.write(vals)
+                param.write({'value': value})
             else:
                 param.unlink()
             return old
         else:
-            vals.update(key=key)
             if value is not False and value is not None:
-                self.create(vals)
+                self.create({'key': key, 'value': value})
             return False
 
+    @api.model
+    def create(self, vals):
+        self.clear_caches()
+        return super(IrConfigParameter, self).create(vals)
+
     @api.multi
     def write(self, vals):
         self.clear_caches()

odoo/addons/base/ir/ir_config_parameter_view.xml

@@ -15,7 +15,6 @@
                 <tree string="System Parameters">
                     <field name="key"/>
                     <field name="value"/>
-                    <field name="group_ids"/>
                 </tree>
             </field>
         </record>
@@ -27,7 +26,6 @@
                     <group>
                         <field name="key"/>
                         <field name="value"/>
-                        <field name="group_ids" widget="many2many_tags"/>
                     </group>
                   </sheet>
                 </form>

odoo/addons/base/ir/ir_model.py

@@ -103,6 +103,12 @@ class IrModel(models.Model):
         ('obj_name_uniq', 'unique (model)', 'Each model must be unique!'),
     ]
 
+    def _get(self, name):
+        """ Return the (sudoed) `ir.model` record with the given name.
+        The result may be an empty recordset if the model is not found.
+        """
+        return self.sudo().search([('model', '=', name)])
+
     # overridden to allow searching both on model name (field 'model') and model
     # description (field 'name')
     @api.model
@@ -393,6 +399,12 @@ class IrModelFields(models.Model):
                     'message': _("The table %r if used for other, possibly incompatible fields.") % self.relation_table,
                 }}
 
+    def _get(self, model_name, name):
+        """ Return the (sudoed) `ir.model.fields` record with the given model and name.
+        The result may be an empty recordset if the model is not found.
+        """
+        return self.sudo().search([('model', '=', model_name), ('name', '=', name)])
+
     @api.multi
     def _drop_column(self):
         tables_to_drop = set()
@@ -848,18 +860,13 @@ class IrModelAccess(models.Model):
             # User root have all accesses
             return True
 
+        assert isinstance(model, basestring), 'Not a model name: %s' % (model,)
         assert mode in ('read', 'write', 'create', 'unlink'), 'Invalid access mode'
 
-        if isinstance(model, models.BaseModel):
-            assert model._name == 'ir.model', 'Invalid model object'
-            model_name = model.model
-        else:
-            model_name = model
-
         # TransientModel records have no access rights, only an implicit access rule
-        if model_name not in self.env:
-            _logger.error('Missing model %s', model_name)
-        elif self.env[model_name].is_transient():
+        if model not in self.env:
+            _logger.error('Missing model %s', model)
+        elif self.env[model].is_transient():
             return True
 
         # We check if a specific rule exists
@@ -870,7 +877,7 @@ class IrModelAccess(models.Model):
                              WHERE m.model = %s
                                AND gu.uid = %s
                                AND a.active IS TRUE""".format(mode=mode),
-                         (model_name, self._uid,))
+                         (model, self._uid,))
         r = self._cr.fetchone()[0]
 
         if not r:
@@ -881,11 +888,11 @@ class IrModelAccess(models.Model):
                                  WHERE a.group_id IS NULL
                                    AND m.model = %s
                                    AND a.active IS TRUE""".format(mode=mode),
-                             (model_name,))
+                             (model,))
             r = self._cr.fetchone()[0]
 
         if not r and raise_exception:
-            groups = '\n\t'.join('- %s' % g for g in self.group_names_with_access(model_name, mode))
+            groups = '\n\t'.join('- %s' % g for g in self.group_names_with_access(model, mode))
             msg_heads = {
                 # Messages are declared in extenso so they are properly exported in translation terms
                 'read': _("Sorry, you are not allowed to access this document."),
@@ -895,11 +902,11 @@ class IrModelAccess(models.Model):
             }
             if groups:
                 msg_tail = _("Only users with the following access level are currently allowed to do that") + ":\n%s\n\n(" + _("Document model") + ": %s)"
-                msg_params = (groups, model_name)
+                msg_params = (groups, model)
             else:
                 msg_tail = _("Please contact your system administrator if you think this is an error.") + "\n\n(" + _("Document model") + ": %s)"
-                msg_params = (model_name,)
-            _logger.info('Access Denied by ACLs for operation: %s, uid: %s, model: %s', mode, self._uid, model_name)
+                msg_params = (model,)
+            _logger.info('Access Denied by ACLs for operation: %s, uid: %s, model: %s', mode, self._uid, model)
             msg = '%s %s' % (msg_heads[mode], msg_tail)
             raise AccessError(msg % msg_params)
 
@@ -1023,7 +1030,7 @@ class IrModelData(models.Model):
         Return (id, res_model, res_id) or raise ValueError if not found
         """
         module, name = xmlid.split('.', 1)
-        xid = self.search([('module', '=', module), ('name', '=', name)])
+        xid = self.sudo().search([('module', '=', module), ('name', '=', name)])
         if not xid:
             raise ValueError('External ID not found in the system: %s' % xmlid)
         # the sql constraints ensure us we have only one result
@@ -1176,7 +1183,7 @@ class IrModelData(models.Model):
             existing_parents = set()            # {parent_model, ...}
             if xml_id:
                 for parent_model, parent_field in record._inherits.iteritems():
-                    xid = self.search([
+                    xid = self.sudo().search([
                         ('module', '=', module),
                         ('name', '=', xml_id + '_' + parent_model.replace('.', '_')),
                     ])

odoo/addons/base/ir/ir_rule.py

@@ -19,7 +19,6 @@ class IrRule(models.Model):
     model_id = fields.Many2one('ir.model', string='Object', index=True, required=True, ondelete="cascade")
     groups = fields.Many2many('res.groups', 'rule_group_rel', 'rule_group_id', 'group_id')
     domain_force = fields.Text(string='Domain')
-    domain = fields.Binary(compute='_force_domain', string='Domain')
     perm_read = fields.Boolean(string='Apply for Read', default=True)
     perm_write = fields.Boolean(string='Apply for Write', default=True)
     perm_create = fields.Boolean(string='Apply for Create', default=True)
@@ -45,15 +44,6 @@ class IrRule(models.Model):
            ir.rule domains."""
         return {'user': self.env.user, 'time': time}
 
-    @api.depends('domain_force')
-    def _force_domain(self):
-        eval_context = self._eval_context()
-        for rule in self:
-            if rule.domain_force:
-                rule.domain = expression.normalize_domain(safe_eval(rule.domain_force, eval_context))
-            else:
-                rule.domain = []
-
     @api.depends('groups')
     def _compute_global(self):
         for rule in self:
@@ -91,29 +81,22 @@ class IrRule(models.Model):
         if not rule_ids:
             return []
 
-        # read 'domain' as self._uid to have the correct eval context for the rules.
-        rules = self.browse(rule_ids)
-        rule_domain = {vals['id']: vals['domain'] for vals in rules.read(['domain'])}
-
         # browse user and rules as SUPERUSER_ID to avoid access errors!
-        user = self.env.user
+        eval_context = self._eval_context()
+        user_groups = self.env.user.groups_id
         global_domains = []                     # list of domains
-        group_domains = defaultdict(list)       # {group: list of domains}
-        for rule in rules.sudo():
-            dom = expression.normalize_domain(rule_domain[rule.id])
-            for group in rule.groups:
-                if group in user.groups_id:
-                    group_domains[group].append(dom)
+        group_domains = []                      # list of domains
+        for rule in self.browse(rule_ids).sudo():
+            # evaluate the domain for the current user
+            dom = safe_eval(rule.domain_force, eval_context) if rule.domain_force else []
+            dom = expression.normalize_domain(dom)
             if not rule.groups:
                 global_domains.append(dom)
+            elif rule.groups & user_groups:
+                group_domains.append(dom)
 
         # combine global domains and group domains
-        if group_domains:
-            group_domain = expression.OR(map(expression.OR, group_domains.values()))
-        else:
-            group_domain = []
-        domain = expression.AND(global_domains + [group_domain])
-        return domain
+        return expression.AND(global_domains + [expression.OR(group_domains)])
 
     @api.model
     def clear_cache(self):

odoo/addons/base/ir/ir_translation.py

@@ -501,7 +501,7 @@ class IrTranslation(models.Model):
         :param model_name: the name of a model
         :return: the model's fields' strings as a dictionary `{field_name: field_string}`
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         return {field.name: field.field_description for field in fields}
 
     @api.model
@@ -513,7 +513,7 @@ class IrTranslation(models.Model):
         :param model_name: the name of a model
         :return: the model's fields' help as a dictionary `{field_name: field_help}`
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         return {field.name: field.help for field in fields}
 
     @api.multi
@@ -752,7 +752,7 @@ class IrTranslation(models.Model):
 
         :return: action definition to open the list of available translations
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         view = self.env.ref("base.view_translation_tree", False) or self.env['ir.ui.view']
         return {
             'name': _("Technical Translations"),

odoo/addons/base/ir/ir_ui_menu.py

@@ -109,15 +109,15 @@ class IrUiMenu(models.Model):
 
         # process action menus, check whether their action is allowed
         access = self.env['ir.model.access']
-        model_fname = {
-            'ir.actions.act_window': 'res_model',
-            'ir.actions.report.xml': 'model',
-            'ir.actions.server': 'model_id',
+        MODEL_GETTER = {
+            'ir.actions.act_window': lambda action: action.res_model,
+            'ir.actions.report.xml': lambda action: action.model,
+            'ir.actions.server': lambda action: action.model_id.model,
         }
-        for menu in action_menus:
-            fname = model_fname.get(menu.action._name)
-            if not fname or not menu.action[fname] or \
-                    access.check(menu.action[fname], 'read', False):
+        for menu in action_menus.sudo():
+            get_model = MODEL_GETTER.get(menu.action._name)
+            if not get_model or not get_model(menu.action) or \
+                    access.check(get_model(menu.action), 'read', False):
                 # make menu visible, and its folder ancestors, too
                 visible += menu
                 menu = menu.parent_id

odoo/addons/base/ir/ir_ui_view.py

@@ -234,20 +234,20 @@ actual arch.
     def _compute_model_data_id(self):
         # get the first ir_model_data record corresponding to self
         domain = [('model', '=', 'ir.ui.view'), ('res_id', 'in', self.ids)]
-        for data in self.env['ir.model.data'].search_read(domain, ['res_id'], order='id desc'):
+        for data in self.env['ir.model.data'].sudo().search_read(domain, ['res_id'], order='id desc'):
             view = self.browse(data['res_id'])
             view.model_data_id = data['id']
 
     def _search_model_data_id(self, operator, value):
         name = 'name' if isinstance(value, basestring) else 'id'
         domain = [('model', '=', 'ir.ui.view'), (name, operator, value)]
-        data = self.env['ir.model.data'].search(domain)
+        data = self.env['ir.model.data'].sudo().search(domain)
         return [('id', 'in', data.mapped('res_id'))]
 
     def _compute_xml_id(self):
         xml_ids = collections.defaultdict(list)
         domain = [('model', '=', 'ir.ui.view'), ('res_id', 'in', self.ids)]
-        for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']):
+        for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']):
             xml_ids[data['res_id']].append("%s.%s" % (data['module'], data['name']))
         for view in self:
             view.xml_id = xml_ids.get(view.id, [''])[0]
@@ -994,7 +994,7 @@ actual arch.
     @tools.ormcache('self.id')
     def get_view_xmlid(self):
         domain = [('model', '=', 'ir.ui.view'), ('res_id', '=', self.id)]
-        xmlid = self.env['ir.model.data'].search_read(domain, ['module', 'name'])[0]
+        xmlid = self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name'])[0]
         return '%s.%s' % (xmlid['module'], xmlid['name'])
 
     @api.model

odoo/addons/base/module/module.py

@@ -86,7 +86,7 @@ class ModuleCategory(models.Model):
     def _compute_xml_id(self):
         xml_ids = defaultdict(list)
         domain = [('model', '=', self._name), ('res_id', 'in', self.ids)]
-        for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']):
+        for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']):
             xml_ids[data['res_id']].append("%s.%s" % (data['module'], data['name']))
         for cat in self:
             cat.xml_id = xml_ids.get(cat.id, [''])[0]
@@ -194,7 +194,7 @@ class Module(models.Model):
             # then, search and group ir.model.data records
             imd_models = defaultdict(list)
             imd_domain = [('module', '=', module.name), ('model', 'in', tuple(dmodels))]
-            for data in IrModelData.search(imd_domain):
+            for data in IrModelData.sudo().search(imd_domain):
                 imd_models[data.model].append(data.res_id)
 
             def browse(model):

odoo/addons/base/module/report/ir_module_reference_print.py

@@ -8,19 +8,19 @@ class IrModelReferenceReport(models.AbstractModel):
 
     @api.model
     def _object_find(self, module):
-        Data = self.env['ir.model.data']
+        Data = self.env['ir.model.data'].sudo()
         data = Data.search([('model','=','ir.model'), ('module','=',module.name)])
         res_ids = data.mapped('res_id')
         return self.env['ir.model'].browse(res_ids)
 
     @api.multi
     def _fields_find(self, model, module):
-        Data = self.env['ir.model.data']
+        Data = self.env['ir.model.data'].sudo()
         fname_wildcard = 'field_' + model.replace('.', '_') + '_%'
         data = Data.search([('model', '=', 'ir.model.fields'), ('module', '=', module.name), ('name', 'like', fname_wildcard)])
         if data:
             res_ids = data.mapped('res_ids')
-            fnames = self.env['ir.model.fields'].browse(res_ids).mapped('name')
+            fnames = self.env['ir.model.fields'].sudo().browse(res_ids).mapped('name')
             return sorted(self.env[model].fields_get(fnames).iteritems())
         return []
 

odoo/addons/base/res/ir_property.py

@@ -79,7 +79,7 @@ class Property(models.Model):
                 else:
                     field_id = self.env['ir.model.fields'].browse(field_id)
 
-                value = '%s,%d' % (field_id.relation, value)
+                value = '%s,%d' % (field_id.sudo().relation, value)
 
         values[field] = value
         return values

odoo/addons/base/security/base_security.xml

@@ -127,16 +127,6 @@
             <field name="domain_force">['|','|',('company_id.child_ids','child_of',[user.company_id.id]),('company_id','child_of',[user.company_id.id]),('company_id','=',False)]</field>
 	</record>
 
-    <record id="ir_config_parameter_rule" model="ir.rule">
-        <field name="name">ICP read rule</field>
-        <field name="model_id" ref="model_ir_config_parameter"/>
-        <field name="domain_force">['|',('group_ids','in', [g.id for g in user.groups_id]), ('group_ids','=',False)]</field>
-        <field name="perm_read" eval="True"/>
-        <field name="perm_create" eval="False"/>
-        <field name="perm_write" eval="False"/>
-        <field name="perm_unlink" eval="False"/>
-    </record>
-
         <record id="res_currency_rate_rule" model="ir.rule">
             <field name="name">multi-company currency rate rule</field>
             <field name="model_id" ref="model_res_currency_rate"/>

odoo/addons/base/security/ir.model.access.csv

@@ -10,19 +10,12 @@
 "access_ir_model_access_group_erp_manager","ir_model_access_group_erp_manager","model_ir_model_access","group_erp_manager",1,1,1,1
 "access_ir_model_data_group_erp_manager","ir_model_data group_erp_manager","model_ir_model_data","group_erp_manager",1,1,1,1
 "access_ir_model_fields_group_erp_manager","ir_model_fields group_erp_manager","model_ir_model_fields","group_erp_manager",1,1,1,1
-"access_ir_model_all","ir_model_all","model_ir_model",,1,0,0,0
-"access_ir_model_constraint","ir_model_constraint","model_ir_model_constraint",,1,0,0,0
-"access_ir_model_relation","ir_model_relation","model_ir_model_relation",,1,0,0,0
-"access_ir_model_access_all","ir_model_access_all","model_ir_model_access",,1,0,0,0
-"access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
-"access_ir_model_fields_all","ir_model_fields all","model_ir_model_fields",,1,0,0,0
 "access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1
 "access_ir_module_module_dependency_group_system","ir_module_module_dependency group_system","model_ir_module_module_dependency","group_system",1,1,1,1
 "access_ir_property_group_user","ir_property group_user","model_ir_property",,1,0,0,0
 "access_ir_property_group_user_manager","ir_property group_manager","model_ir_property","base.group_partner_manager",1,1,1,0
-"access_ir_rule_group_user","ir_rule group_user","model_ir_rule",,1,0,0,0
 "access_ir_rule_group_erp_manager","ir_rule group_erp_manager","model_ir_rule","group_erp_manager",1,1,1,1
 "access_ir_sequence_group_user","ir_sequence group_user","model_ir_sequence","group_user",1,0,0,0
 "access_ir_sequence_group_system","ir_sequence group_system","model_ir_sequence","group_system",1,1,1,1
@@ -87,8 +80,10 @@
 "access_res_bank_group_system","res_bank_group_system","model_res_bank","group_system",1,1,1,1
 "access_res_bank_group_partner_manager","res_bank_group_partner_manager","model_res_bank","group_partner_manager",1,1,1,1
 "access_res_bank_user","res_bank user","model_res_bank","group_user",1,0,0,0
-"access_ir_filter all","ir_filters all","model_ir_filters",,1,1,1,1
-"access_ir_config_parameter","ir_config_parameter","model_ir_config_parameter",,1,0,0,0
+"access_ir_filter_erp_manager","ir_filters all","model_ir_filters","group_erp_manager",1,1,1,1
+"access_ir_filter_user","ir_filters all","model_ir_filters","group_user",1,1,1,1
+"access_ir_filter_portal","ir_filters all","model_ir_filters","group_portal",1,1,1,1
+"access_ir_filter_public","ir_filters all","model_ir_filters","group_public",1,1,1,1
 "access_ir_config_parameter_system","ir_config_parameter_system","model_ir_config_parameter","group_system",1,1,1,1
 "access_ir_mail_server","ir_mail_server","model_ir_mail_server","group_system",1,1,1,1
 "access_ir_actions_client","ir_actions_client all","model_ir_actions_client",,1,0,0,0

odoo/addons/test_new_api/models.py

@@ -227,7 +227,7 @@ class MixedModel(models.Model):
 
     @api.model
     def _reference_models(self):
-        models = self.env['ir.model'].search([('state', '!=', 'manual')])
+        models = self.env['ir.model'].sudo().search([('state', '!=', 'manual')])
         return [(model.model, model.name)
                 for model in models
                 if not model.model.startswith('ir.')]

odoo/models.py

@@ -4434,7 +4434,7 @@ class BaseModel(object):
         """
         result = {record.id: [] for record in self}
         domain = [('model', '=', self._name), ('res_id', 'in', self.ids)]
-        for data in self.env['ir.model.data'].search_read(domain, ['module', 'name', 'res_id']):
+        for data in self.env['ir.model.data'].sudo().search_read(domain, ['module', 'name', 'res_id']):
             result[data['res_id']].append('%(module)s.%(name)s' % data)
         return result
 

odoo/report/custom.py

@@ -118,7 +118,7 @@ class report_custom(report_int):
         report = report.read()[0]
         fields = env['ir.report.custom.fields'].browse(report['fields_child0']).read()
         fields.sort(key=lambda x: x['sequence'])
-        model_name = env['ir.model'].browse(report['model_id'][0]).model
+        model_name = env['ir.model'].browse(report['model_id'][0]).sudo().model
 
         fct = {
             'id': lambda x: x,
@@ -134,7 +134,7 @@ class report_custom(report_int):
                 field_child = f['field_child'+str(i)]
                 if field_child:
                     row.append(
-                        env['ir.model.fields'].browse(field_child[0]).name
+                        env['ir.model.fields'].sudo().browse(field_child[0]).name
                     )
                     if f['fc'+str(i)+'_operande']:
                         fct_name = 'id'
@@ -342,7 +342,7 @@ class report_custom(report_int):
         for f in fields:
             field_id = (f['field_child3'] and f['field_child3'][0]) or (f['field_child2'] and f['field_child2'][0]) or (f['field_child1'] and f['field_child1'][0]) or (f['field_child0'] and f['field_child0'][0])
             if field_id:
-                ttype = env['ir.model.fields'].browse(field_id).ttype
+                ttype = env['ir.model.fields'].sudo().browse(field_id).ttype
                 if ttype == 'date':
                     date_idx = idx
                     fct[idx] = process_date[report['frequency']] 
@@ -435,7 +435,7 @@ class report_custom(report_int):
         for f in fields:
             field_id = (f['field_child3'] and f['field_child3'][0]) or (f['field_child2'] and f['field_child2'][0]) or (f['field_child1'] and f['field_child1'][0]) or (f['field_child0'] and f['field_child0'][0])
             if field_id:
-                ttype = env['ir.model.fields'].browse(field_id).ttype
+                ttype = env['ir.model.fields'].sudo().browse(field_id).ttype
                 if ttype == 'date':
                     date_idx = idx
                     fct[idx] = process_date[report['frequency']] 

odoo/report/printscreen/ps_list.py

@@ -51,7 +51,7 @@ class report_printscreen_list(report_int):
         self.groupby_no_leaf = context.get('group_by_no_leaf', False)
         env = odoo.api.Environment(cr, uid, context)
         Model = env[datas['model']]
-        model = env['ir.model'].search([('model', '=', Model._name)])
+        model = env['ir.model']._get(Model._name)
         model_desc = model.name or Model._description
         self.title = model_desc
         datas['ids'] = ids