[IMP] base: remove read access to ir.ui.view

Only system users should be able to access directly ir.ui.view records
Other users should use helper methods like fields_view_get or render
to interact with view records (or use sudo)

Give read access to views to publisher
He needs to call read_template on some views like
'web_editor.colorpicker' in edition mode

Restrict ACL on website.page
Apply the same ACL than on ir.ui.view as the model inherits from it.
Give access to designer to modify views

addons/website/security/ir.model.access.csv

@@ -5,9 +5,10 @@ access_website_menu,access_website_menu,model_website_menu,,1,0,0,0
 access_website_menu_designer,Web Menu Manager,model_website_menu,group_website_designer,1,1,1,1
 access_website_rewrite,access_website_rewrite,model_website_rewrite,,0,0,0,0
 access_website_rewrite_designer,Web Rewrite Manager,model_website_rewrite,group_website_designer,1,1,1,1
-access_website_page,access_website_page,model_website_page,,1,0,0,0
+access_website_page,access_website_page,model_website_page,,0,0,0,0
 access_website_page_designer,Web Page Manager,model_website_page,group_website_designer,1,1,1,1
-access_website_ir_ui_view,access_website_ir_ui_view,model_ir_ui_view,group_website_designer,1,1,1,1
+access_website_ir_ui_view_publisher,access_website_ir_ui_view_publisher,model_ir_ui_view,group_website_publisher,1,0,0,0
+access_website_ir_ui_view_designer,access_website_ir_ui_view_designer,model_ir_ui_view,group_website_designer,1,1,1,1
 access_seo_public,access_seo_public,model_website_seo_metadata,,1,0,0,0
 access_seo_designer,access_seo_designer,model_website_seo_metadata,group_website_designer,1,1,1,1
 access_website_visitor_designer,access_website_visitor_designer,model_website_visitor,website.group_website_designer,1,1,0,1

odoo/addons/base/security/ir.model.access.csv

@@ -31,7 +31,7 @@
 "access_ir_translation_group_system","ir_translation group_system","model_ir_translation","group_system",1,1,1,1
 "access_ir_ui_menu_group_user","ir_ui_menu group_user","model_ir_ui_menu",base.group_user,1,0,0,0
 "access_ir_ui_menu_group_system","ir_ui_menu group_system","model_ir_ui_menu","group_system",1,1,1,1
-"access_ir_ui_view_group_user","ir_ui_view group_user","model_ir_ui_view",,1,0,0,0
+"access_ir_ui_view_group_user","ir_ui_view group_user","model_ir_ui_view",,0,0,0,0
 "access_ir_ui_view_group_system","ir_ui_view group_system","model_ir_ui_view","group_system",1,1,1,1
 "access_reset_view_arch_wizard_group_system","reset_view_arch_wizard group_system","model_reset_view_arch_wizard","group_system",1,1,1,0
 "access_ir_ui_view_custom_group_user","ir_ui_view_custom_group_user","model_ir_ui_view_custom",,1,1,1,1

odoo/addons/base/tests/test_views.py

@@ -9,7 +9,7 @@ from lxml import etree
 from lxml.builder import E
 from psycopg2 import IntegrityError
 
-from odoo.exceptions import ValidationError
+from odoo.exceptions import AccessError, ValidationError
 from odoo.tests import common
 from odoo.tools import mute_logger, view_validation
 from odoo.addons.base.models.ir_ui_view import (
@@ -2923,6 +2923,20 @@ class TestValidationTools(common.BaseCase):
             {'x', 'y', 'z'},
         )
 
+class TestAccessRights(common.TransactionCase):
+
+    @common.users('demo')
+    def test_access(self):
+        # a user can not access directly a view
+        with self.assertRaises(AccessError):
+            self.env['ir.ui.view'].search([("model", '=', "res.partner"), ('type', '=', 'form')])
+
+        # but can call fields_view_get
+        self.env['res.partner'].fields_view_get(view_type='form')
+
+        # unless he does not have access to the model
+        with self.assertRaises(AccessError):
+            self.env['ir.ui.view'].fields_view_get(view_type='form')
 
 @common.tagged('post_install', '-at_install', '-standard', 'migration')
 class TestAllViews(common.TransactionCase):