[IMP] base: tighten `ir.model.fields` access rights

11 files changed, 22 insertions, 17 deletions

diff --git a/addons/account/models/chart_template.py b/addons/account/models/chart_template.py
index c228eb5f604..2f5f40df280 100644
--- a/addons/account/models/chart_template.py
+++ b/addons/account/models/chart_template.py
@@ -226,7 +226,7 @@ class AccountChartTemplate(models.Model):
             account = getattr(self, record[0])
             value = account and 'account.account,' + str(acc_template_ref[account.id]) or False
             if value:
-                field = self.env['ir.model.fields'].search([('name', '=', record[0]), ('model', '=', record[1]), ('relation', '=', record[2])], limit=1)
+                field = self.env['ir.model.fields'].sudo().search([('name', '=', record[0]), ('model', '=', record[1]), ('relation', '=', record[2])])
                 vals = {
                     'name': record[0],
                     'company_id': company.id,
diff --git a/addons/crm/wizard/base_partner_merge.py b/addons/crm/wizard/base_partner_merge.py
index 44320807797..4eac5798645 100644
--- a/addons/crm/wizard/base_partner_merge.py
+++ b/addons/crm/wizard/base_partner_merge.py
@@ -233,8 +233,8 @@ class MergePartnerAutomatic(models.TransientModel):
             update_records('marketing.campaign.workitem', src=partner, field_model='object_id.model')
             update_records('ir.model.data', src=partner)
 
-        records = self.env['ir.model.fields'].search([('ttype', '=', 'reference')])
-        for record in records.sudo():
+        records = self.env['ir.model.fields'].sudo().search([('ttype', '=', 'reference')])
+        for record in records:
             try:
                 Model = self.env[record.model]
                 field = Model._fields[record.name]
@@ -250,7 +250,7 @@ class MergePartnerAutomatic(models.TransientModel):
                 values = {
                     record.name: 'res.partner,%d' % dst_partner.id,
                 }
-                records_ref.sudo().write(values)
+                records_ref.write(values)
 
     @api.model
     def _update_values(self, src_partners, dst_partner):
diff --git a/addons/product/models/res_company.py b/addons/product/models/res_company.py
index 05e27d47e59..81bdc631177 100644
--- a/addons/product/models/res_company.py
+++ b/addons/product/models/res_company.py
@@ -17,7 +17,7 @@ class ResCompany(models.Model):
                 'name': new_company.name,
                 'currency_id': new_company.currency_id.id,
             })
-        field = self.env['ir.model.fields'].search([('model', '=', 'res.partner'), ('name', '=', 'property_product_pricelist')])
+        field = self.env['ir.model.fields']._get('res.partner', 'property_product_pricelist')
         self.env['ir.property'].create({
             'name': 'property_product_pricelist',
             'company_id': new_company.id,
diff --git a/addons/stock_account/models/account_chart_template.py b/addons/stock_account/models/account_chart_template.py
index fdf75e5978e..81de769e45d 100644
--- a/addons/stock_account/models/account_chart_template.py
+++ b/addons/stock_account/models/account_chart_template.py
@@ -21,7 +21,7 @@ class AccountChartTemplate(models.Model):
         PropertyObj = self.env['ir.property']  # Property Stock Journal
         value = self.env['account.journal'].search([('company_id', '=', company.id), ('code', '=', 'STJ'), ('type', '=', 'general')], limit=1)
         if value:
-            field = self.env['ir.model.fields'].search([('name', '=', 'property_stock_journal'), ('model', '=', 'product.category'), ('relation', '=', 'account.journal')], limit=1)
+            field = self.env['ir.model.fields'].sudo().search([('name', '=', 'property_stock_journal'), ('model', '=', 'product.category'), ('relation', '=', 'account.journal')])
             vals = {
                 'name': 'property_stock_journal',
                 'company_id': company.id,
@@ -45,7 +45,7 @@ class AccountChartTemplate(models.Model):
             account = getattr(self, record)
             value = account and 'account.account,' + str(acc_template_ref[account.id]) or False
             if value:
-                field = self.env['ir.model.fields'].search([('name', '=', record), ('model', '=', 'product.category'), ('relation', '=', 'account.account')], limit=1)
+                field = self.env['ir.model.fields'].sudo().search([('name', '=', record), ('model', '=', 'product.category'), ('relation', '=', 'account.account')])
                 vals = {
                     'name': record,
                     'company_id': company.id,
diff --git a/addons/web_diagram/controllers/main.py b/addons/web_diagram/controllers/main.py
index 22761f6cd22..0cc360f064b 100644
--- a/addons/web_diagram/controllers/main.py
+++ b/addons/web_diagram/controllers/main.py
@@ -76,7 +76,7 @@ class DiagramView(http.Controller):
             for i, fld in enumerate(connector_fields):
                 t['options'][connector_fields_string[i]] = tr[fld]
 
-        fields = http.request.env['ir.model.fields']
+        fields = http.request.env['ir.model.fields'].sudo()
         field = fields.search([('model', '=', model), ('relation', '=', node)])
         node_act = http.request.env[node]
         search_acts = node_act.search([(field.relation_field, '=', id)])
diff --git a/odoo/addons/base/ir/ir_model.py b/odoo/addons/base/ir/ir_model.py
index 8d037a73097..044d3b16f47 100644
--- a/odoo/addons/base/ir/ir_model.py
+++ b/odoo/addons/base/ir/ir_model.py
@@ -399,6 +399,12 @@ class IrModelFields(models.Model):
                     'message': _("The table %r if used for other, possibly incompatible fields.") % self.relation_table,
                 }}
 
+    def _get(self, model_name, name):
+        """ Return the (sudoed) `ir.model.fields` record with the given model and name.
+        The result may be an empty recordset if the model is not found.
+        """
+        return self.sudo().search([('model', '=', model_name), ('name', '=', name)])
+
     @api.multi
     def _drop_column(self):
         tables_to_drop = set()
diff --git a/odoo/addons/base/ir/ir_translation.py b/odoo/addons/base/ir/ir_translation.py
index 46f3dbba1a0..4e29abea7a5 100644
--- a/odoo/addons/base/ir/ir_translation.py
+++ b/odoo/addons/base/ir/ir_translation.py
@@ -501,7 +501,7 @@ class IrTranslation(models.Model):
         :param model_name: the name of a model
         :return: the model's fields' strings as a dictionary `{field_name: field_string}`
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         return {field.name: field.field_description for field in fields}
 
     @api.model
@@ -513,7 +513,7 @@ class IrTranslation(models.Model):
         :param model_name: the name of a model
         :return: the model's fields' help as a dictionary `{field_name: field_help}`
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         return {field.name: field.help for field in fields}
 
     @api.multi
@@ -752,7 +752,7 @@ class IrTranslation(models.Model):
 
         :return: action definition to open the list of available translations
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         view = self.env.ref("base.view_translation_tree", False) or self.env['ir.ui.view']
         return {
             'name': _("Technical Translations"),
diff --git a/odoo/addons/base/module/report/ir_module_reference_print.py b/odoo/addons/base/module/report/ir_module_reference_print.py
index 19587b3cb8f..813662bf945 100644
--- a/odoo/addons/base/module/report/ir_module_reference_print.py
+++ b/odoo/addons/base/module/report/ir_module_reference_print.py
@@ -20,7 +20,7 @@ class IrModelReferenceReport(models.AbstractModel):
         data = Data.search([('model', '=', 'ir.model.fields'), ('module', '=', module.name), ('name', 'like', fname_wildcard)])
         if data:
             res_ids = data.mapped('res_ids')
-            fnames = self.env['ir.model.fields'].browse(res_ids).mapped('name')
+            fnames = self.env['ir.model.fields'].sudo().browse(res_ids).mapped('name')
             return sorted(self.env[model].fields_get(fnames).iteritems())
         return []
 
diff --git a/odoo/addons/base/res/ir_property.py b/odoo/addons/base/res/ir_property.py
index de3f4d9d214..82db6eba933 100644
--- a/odoo/addons/base/res/ir_property.py
+++ b/odoo/addons/base/res/ir_property.py
@@ -79,7 +79,7 @@ class Property(models.Model):
                 else:
                     field_id = self.env['ir.model.fields'].browse(field_id)
 
-                value = '%s,%d' % (field_id.relation, value)
+                value = '%s,%d' % (field_id.sudo().relation, value)
 
         values[field] = value
         return values
diff --git a/odoo/addons/base/security/ir.model.access.csv b/odoo/addons/base/security/ir.model.access.csv
index 432c566d506..985089057ea 100644
--- a/odoo/addons/base/security/ir.model.access.csv
+++ b/odoo/addons/base/security/ir.model.access.csv
@@ -14,7 +14,6 @@
 "access_ir_model_access_all","ir_model_access_all","model_ir_model_access",,1,0,0,0
 "access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
-"access_ir_model_fields_all","ir_model_fields all","model_ir_model_fields",,1,0,0,0
 "access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1
 "access_ir_module_module_dependency_group_system","ir_module_module_dependency group_system","model_ir_module_module_dependency","group_system",1,1,1,1
diff --git a/odoo/report/custom.py b/odoo/report/custom.py
index e2fc352ad37..ae61614c895 100644
--- a/odoo/report/custom.py
+++ b/odoo/report/custom.py
@@ -134,7 +134,7 @@ class report_custom(report_int):
                 field_child = f['field_child'+str(i)]
                 if field_child:
                     row.append(
-                        env['ir.model.fields'].browse(field_child[0]).name
+                        env['ir.model.fields'].sudo().browse(field_child[0]).name
                     )
                     if f['fc'+str(i)+'_operande']:
                         fct_name = 'id'
@@ -342,7 +342,7 @@ class report_custom(report_int):
         for f in fields:
             field_id = (f['field_child3'] and f['field_child3'][0]) or (f['field_child2'] and f['field_child2'][0]) or (f['field_child1'] and f['field_child1'][0]) or (f['field_child0'] and f['field_child0'][0])
             if field_id:
-                ttype = env['ir.model.fields'].browse(field_id).ttype
+                ttype = env['ir.model.fields'].sudo().browse(field_id).ttype
                 if ttype == 'date':
                     date_idx = idx
                     fct[idx] = process_date[report['frequency']] 
@@ -435,7 +435,7 @@ class report_custom(report_int):
         for f in fields:
             field_id = (f['field_child3'] and f['field_child3'][0]) or (f['field_child2'] and f['field_child2'][0]) or (f['field_child1'] and f['field_child1'][0]) or (f['field_child0'] and f['field_child0'][0])
             if field_id:
-                ttype = env['ir.model.fields'].browse(field_id).ttype
+                ttype = env['ir.model.fields'].sudo().browse(field_id).ttype
                 if ttype == 'date':
                     date_idx = idx
                     fct[idx] = process_date[report['frequency']]