[FIX] account: improve security in reports and in account's query_get()

* privatize the get_report_values() method
* check read access rights and ir.rules in _query_get() from account module

Was task 36590
Was PR #25822

addons/account/models/account_move.py

@@ -1271,6 +1271,8 @@ class AccountMoveLine(models.Model):
 
     @api.model
     def _query_get(self, domain=None):
+        self.check_access_rights('read')
+
         context = dict(self._context or {})
         domain = domain or []
         if not isinstance(domain, (list, tuple)):
@@ -1328,6 +1330,10 @@ class AccountMoveLine(models.Model):
         tables = ''
         if domain:
             query = self._where_calc(domain)
+
+            # Wrap the query with 'company_id IN (...)' to avoid bypassing company access rights.
+            self._apply_ir_rules(query)
+
             tables, where_clause, where_clause_params = query.get_sql()
         return tables, where_clause, where_clause_params
 

addons/account/report/account_aged_partner_balance.py

@@ -211,7 +211,7 @@ class ReportAgedPartnerBalance(models.AbstractModel):
         return res, total, lines
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/account/report/account_balance.py

@@ -59,7 +59,7 @@ class ReportTrialBalance(models.AbstractModel):
 
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/account/report/account_general_ledger.py

@@ -109,7 +109,7 @@ class ReportGeneralLedger(models.AbstractModel):
         return account_res
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/account/report/account_invoice_report.py

@@ -179,7 +179,7 @@ class ReportInvoiceWithPayment(models.AbstractModel):
     _name = 'report.account.report_invoice_with_payments'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         report = self.env['ir.actions.report']._get_report_from_name('account.report_invoice_with_payments')
         return {
             'doc_ids': docids,

addons/account/report/account_journal.py

@@ -95,7 +95,7 @@ class ReportJournal(models.AbstractModel):
         return self.env['account.move.line'].with_context(data['form'].get('used_context', {}))._query_get()
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/account/report/account_overdue_report.py

@@ -31,7 +31,7 @@ class ReportOverdue(models.AbstractModel):
         return res
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         totals = {}
         lines = self._get_account_move_lines(docids)
         lines_to_display = {}

addons/account/report/account_partner_ledger.py

@@ -69,7 +69,7 @@ class ReportPartnerLedger(models.AbstractModel):
         return result
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/account/report/account_report_financial.py

@@ -144,7 +144,7 @@ class ReportFinancial(models.AbstractModel):
         return lines
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/account/report/account_tax.py

@@ -8,7 +8,7 @@ class ReportTax(models.AbstractModel):
     _name = 'report.account.report_tax'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
         return {

addons/account_test/report/report_account_test.py

@@ -61,7 +61,7 @@ class ReportAssertAccount(models.AbstractModel):
         return result
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         report = self.env['ir.actions.report']._get_report_from_name('account_test.report_accounttest')
         records = self.env['accounting.assert.test'].browse(self.ids)
         return {

addons/hr_holidays/report/holidays_summary_report.py

@@ -107,7 +107,7 @@ class HrHolidaySummaryReport(models.AbstractModel):
         return res
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/hr_payroll/report/report_contribution_register.py

@@ -29,7 +29,7 @@ class ContributionRegisterReport(models.AbstractModel):
         return result
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/hr_payroll/report/report_payslip_details.py

@@ -86,7 +86,7 @@ class PayslipDetailsReport(models.AbstractModel):
         return res
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         payslips = self.env['hr.payslip'].browse(docids)
         return {
             'doc_ids': docids,

addons/l10n_fr_hr_payroll/report/fiche_paye.py

@@ -30,7 +30,7 @@ class FichePayeParser(models.AbstractModel):
         return self.env['hr.payslip.line'].search([('slip_id', '=', obj.id), ('salary_rule_id.parent_rule_id.id', '=', parent_line.salary_rule_id.id)], limit=1)
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         payslip = self.env['hr.payslip'].browse(docids)
         return {
             'doc_ids': docids,

addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py

@@ -93,7 +93,7 @@ class ReportHrSalaryEmployeeBymonth(models.AbstractModel):
         return self.total
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py

@@ -126,7 +126,7 @@ class EmployeesYearlySalaryReport(models.AbstractModel):
         return self.total
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not self.env.context.get('active_model') or not self.env.context.get('active_id'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 

addons/l10n_in_hr_payroll/report/report_payroll_advice.py

@@ -42,7 +42,7 @@ class payroll_advice_report(models.AbstractModel):
         return result
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         advice = self.env['hr.payroll.advice'].browse(docids)
         return {
             'doc_ids': docids,

addons/l10n_in_hr_payroll/report/report_payslip_details.py

@@ -9,7 +9,7 @@ class PayslipDetailsReportIN(models.AbstractModel):
     _inherit = 'report.hr_payroll.report_payslipdetails'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         payslips = self.env['hr.payslip'].browse(docids)
         return {
             'doc_ids': docids,

addons/mrp/report/mrp_report_bom_structure.py

@@ -9,7 +9,7 @@ class ReportBomStructure(models.AbstractModel):
     _name = 'report.mrp.report_bom_structure'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         docs = []
         for bom_id in docids:
             bom = self.env['mrp.bom'].browse(bom_id)

addons/point_of_sale/models/pos_order.py

@@ -1124,7 +1124,7 @@ class ReportSaleDetails(models.AbstractModel):
         }
 
     @api.multi
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         data = dict(data or {})
         configs = self.env['pos.config'].browse(data['config_ids'])
         data.update(self.get_sale_details(data['date_start'], data['date_stop'], configs))

addons/point_of_sale/report/pos_invoice.py

@@ -9,7 +9,7 @@ class PosInvoiceReport(models.AbstractModel):
     _name = 'report.point_of_sale.report_invoice'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         PosOrder = self.env['pos.order']
         ids_to_print = []
         invoiced_posorders_ids = []

addons/product/report/product_pricelist.py

@@ -9,7 +9,7 @@ class report_product_pricelist(models.AbstractModel):
     _name = 'report.product.report_pricelist'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         data = data if data is not None else {}
         pricelist = self.env['product.pricelist'].browse(data.get('form', {}).get('price_list', False))
         products = self.env['product.product'].browse(data.get('ids', data.get('active_ids')))

addons/sale/report/sale_report.py

@@ -135,7 +135,7 @@ class SaleOrderReportProforma(models.AbstractModel):
     _name = 'report.sale.report_saleproforma'
 
     @api.multi
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         docs = self.env['sale.order'].browse(docids)
         return {
             'doc_ids': docs.ids,

odoo/addons/base/models/ir_actions_report.py

@@ -658,7 +658,7 @@ class IrActionsReport(models.Model):
         report_model = self.env.get(report_model_name)
 
         if report_model is not None:
-            data = report_model.get_report_values(docids, data=data)
+            data = report_model._get_report_values(docids, data=data)
         else:
             docs = self.env[self.model].browse(docids)
             data = {

odoo/addons/base/report/report_base_report_irmodulereference.py

@@ -26,7 +26,7 @@ class IrModelReferenceReport(models.AbstractModel):
         return []
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         report = self.env['ir.actions.report']._get_report_from_name('base.report_irmodulereference')
         selected_modules = self.env['ir.module.module'].browse(docids)
         return {