[IMP] base, *: tighten `ir.config_parameter` access rights

Add `base.group_system` on existing parameters:
 - `auth_signup.allow_uninvited`,
 - `auth_signup.reset_password`,
 - `auth_signup.template_user_id`,
 - `google_redirect_uri`,
 - `mail.bounce.alias`,
 - `mail.catchall.alias`,
 - `mail.catchall.domain`.

22 files changed, 44 insertions, 37 deletions

diff --git a/addons/auth_signup/controllers/main.py b/addons/auth_signup/controllers/main.py
index 2718e47dd2a..8a4315a0ad8 100644
--- a/addons/auth_signup/controllers/main.py
+++ b/addons/auth_signup/controllers/main.py
@@ -70,10 +70,10 @@ class AuthSignupHome(Home):
     def get_auth_signup_config(self):
         """retrieve the module config (which features are enabled) for the login page"""
 
-        IrConfigParam = request.env['ir.config_parameter']
+        IrConfigParam = request.env['ir.config_parameter'].sudo()
         return {
-            'signup_enabled': IrConfigParam.sudo().get_param('auth_signup.allow_uninvited') == 'True',
-            'reset_password_enabled': IrConfigParam.sudo().get_param('auth_signup.reset_password') == 'True',
+            'signup_enabled': IrConfigParam.get_param('auth_signup.allow_uninvited') == 'True',
+            'reset_password_enabled': IrConfigParam.get_param('auth_signup.reset_password') == 'True',
         }
 
     def get_auth_signup_qcontext(self):
diff --git a/addons/auth_signup/data/auth_signup_data.xml b/addons/auth_signup/data/auth_signup_data.xml
index 2cc3d07195c..ce35baac34b 100644
--- a/addons/auth_signup/data/auth_signup_data.xml
+++ b/addons/auth_signup/data/auth_signup_data.xml
@@ -14,6 +14,7 @@
         <record id="default_template_user_config" model="ir.config_parameter">
             <field name="key">auth_signup.template_user_id</field>
             <field name="value" ref="default_template_user"/>
+            <field name="group_ids" eval="[(4, ref('base.group_system'))]"/>
         </record>
 
         <!-- Email template for reset password -->
diff --git a/addons/auth_signup/models/res_config.py b/addons/auth_signup/models/res_config.py
index bfb89e76d3d..9256ef3f093 100644
--- a/addons/auth_signup/models/res_config.py
+++ b/addons/auth_signup/models/res_config.py
@@ -26,6 +26,6 @@ class BaseConfigSettings(models.TransientModel):
         self.ensure_one()
         IrConfigParam = self.env['ir.config_parameter']
         # we store the repr of the values, since the value of the parameter is a required string
-        IrConfigParam.set_param('auth_signup.reset_password', repr(self.auth_signup_reset_password))
-        IrConfigParam.set_param('auth_signup.allow_uninvited', repr(self.auth_signup_uninvited))
-        IrConfigParam.set_param('auth_signup.template_user_id', repr(self.auth_signup_template_user_id.id))
+        IrConfigParam.set_param('auth_signup.reset_password', repr(self.auth_signup_reset_password), groups=['base.group_system'])
+        IrConfigParam.set_param('auth_signup.allow_uninvited', repr(self.auth_signup_uninvited), groups=['base.group_system'])
+        IrConfigParam.set_param('auth_signup.template_user_id', repr(self.auth_signup_template_user_id.id), groups=['base.group_system'])
diff --git a/addons/auth_signup/models/res_users.py b/addons/auth_signup/models/res_users.py
index c82a35792a2..889745df1e1 100644
--- a/addons/auth_signup/models/res_users.py
+++ b/addons/auth_signup/models/res_users.py
@@ -75,6 +75,7 @@ class ResUsers(models.Model):
     @api.model
     def _signup_create_user(self, values):
         """ create a new user from the template user """
+        # we expect self.uid == SUPERUSER_ID
         IrConfigParam = self.env['ir.config_parameter']
         template_user_id = literal_eval(IrConfigParam.get_param('auth_signup.template_user_id', 'False'))
         template_user = self.browse(template_user_id)
diff --git a/addons/crm/models/res_config.py b/addons/crm/models/res_config.py
index 295dbaca25a..e30b7b16fd1 100644
--- a/addons/crm/models/res_config.py
+++ b/addons/crm/models/res_config.py
@@ -10,7 +10,7 @@ class CRMSettings(models.TransientModel):
     generate_sales_team_alias = fields.Boolean("Automatically generate an email alias at the sales team creation",
         help="Odoo will generate an email alias based on the sales team name")
     alias_prefix = fields.Char('Default Alias Name for Leads')
-    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
     default_generate_lead_from_alias = fields.Boolean(default_model='sale.config.settings')
     group_use_lead = fields.Boolean(string="Leads", implied_group='crm.group_use_lead')
     module_crm_voip = fields.Boolean("Asterisk (VoIP)")
diff --git a/addons/google_account/data/google_account_data.xml b/addons/google_account/data/google_account_data.xml
index 1c3a5f4089e..eda1b51a8f3 100644
--- a/addons/google_account/data/google_account_data.xml
+++ b/addons/google_account/data/google_account_data.xml
@@ -4,6 +4,7 @@
     	<record id="config_google_redirect_uri" model="ir.config_parameter">
             <field name="key">google_redirect_uri</field>
             <field name="value">urn:ietf:wg:oauth:2.0:oob</field>
+            <field name="group_ids" eval="[(4, ref('base.group_system'))]"/>
         </record>
     </data>
 </odoo>
diff --git a/addons/hr_expense/models/res_config.py b/addons/hr_expense/models/res_config.py
index c1eda4f459b..27320517cf4 100644
--- a/addons/hr_expense/models/res_config.py
+++ b/addons/hr_expense/models/res_config.py
@@ -7,7 +7,7 @@ class HrExpenseConfigSettings(models.TransientModel):
     _inherit = 'res.config.settings'
 
     alias_prefix = fields.Char('Default Alias Name for Expenses')
-    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
 
     @api.model
     def get_default_alias_prefix(self, fields):
diff --git a/addons/im_livechat/models/im_livechat_channel.py b/addons/im_livechat/models/im_livechat_channel.py
index 2041697bd03..1f152e01054 100644
--- a/addons/im_livechat/models/im_livechat_channel.py
+++ b/addons/im_livechat/models/im_livechat_channel.py
@@ -70,7 +70,7 @@ class ImLivechatChannel(models.Model):
     def _compute_script_external(self):
         view = self.env['ir.model.data'].get_object('im_livechat', 'external_loader')
         values = {
-            "url": self.env['ir.config_parameter'].sudo().get_param('web.base.url'),
+            "url": self.env['ir.config_parameter'].get_param('web.base.url'),
             "dbname": self._cr.dbname,
         }
         for record in self:
@@ -79,7 +79,7 @@ class ImLivechatChannel(models.Model):
 
     @api.multi
     def _compute_web_page_link(self):
-        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
         for record in self:
             record.web_page = "%s/im_livechat/support/%i" % (base_url, record.id)
 
diff --git a/addons/mail/data/mail_data.xml b/addons/mail/data/mail_data.xml
index aa4cae02f30..99df3e80737 100644
--- a/addons/mail/data/mail_data.xml
+++ b/addons/mail/data/mail_data.xml
@@ -37,12 +37,14 @@
         <record id="icp_mail_catchall_alias" model="ir.config_parameter">
             <field name="key">mail.catchall.alias</field>
             <field name="value">catchall</field>
+            <field name="group_ids" eval="[(4, ref('base.group_system'))]"/>
         </record>
 
         <!-- Bounce Email Alias -->
         <record id="icp_mail_bounce_alias" model="ir.config_parameter">
             <field name="key">mail.bounce.alias</field>
             <field name="value">bounce</field>
+            <field name="group_ids" eval="[(4, ref('base.group_system'))]"/>
         </record>
 
         <!-- Discussion subtype for messaging / Chatter -->
diff --git a/addons/mail/models/mail_alias.py b/addons/mail/models/mail_alias.py
index 6acf894c996..eee18d10c5b 100644
--- a/addons/mail/models/mail_alias.py
+++ b/addons/mail/models/mail_alias.py
@@ -63,7 +63,7 @@ class Alias(models.Model):
         help="Optional ID of a thread (record) to which all incoming messages will be attached, even "
              "if they did not reply to it. If set, this will disable the creation of new records completely.")
     alias_domain = fields.Char('Alias domain', compute='_get_alias_domain',
-                               default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+                               default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
     alias_parent_model_id = fields.Many2one(
         'ir.model', 'Parent Model',
         help="Parent model holding the alias. The model holding the alias reference "
@@ -86,7 +86,7 @@ class Alias(models.Model):
 
     @api.multi
     def _get_alias_domain(self):
-        alias_domain = self.env["ir.config_parameter"].get_param("mail.catchall.domain")
+        alias_domain = self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain")
         for record in self:
             record.alias_domain = alias_domain
 
diff --git a/addons/mail/models/mail_mail.py b/addons/mail/models/mail_mail.py
index 26fe8e052e4..527afc1c0cd 100644
--- a/addons/mail/models/mail_mail.py
+++ b/addons/mail/models/mail_mail.py
@@ -233,8 +233,9 @@ class MailMail(models.Model):
 
                 # headers
                 headers = {}
-                bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
-                catchall_domain = self.env['ir.config_parameter'].get_param("mail.catchall.domain")
+                ICP = self.env['ir.config_parameter'].sudo()
+                bounce_alias = ICP.get_param("mail.bounce.alias")
+                catchall_domain = ICP.get_param("mail.catchall.domain")
                 if bounce_alias and catchall_domain:
                     if mail.model and mail.res_id:
                         headers['Return-Path'] = '%s+%d-%s-%d@%s' % (bounce_alias, mail.id, mail.model, mail.res_id, catchall_domain)
diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py
index ef27ab2d7c2..6bc7cbffbe0 100644
--- a/addons/mail/models/mail_thread.py
+++ b/addons/mail/models/mail_thread.py
@@ -745,7 +745,7 @@ class MailThread(models.AbstractModel):
         alias of the document, if it exists. Override this method to implement
         a custom behavior about reply-to for generated emails. """
         model_name = self.env.context.get('thread_model') or self._name
-        alias_domain = self.env['ir.config_parameter'].get_param("mail.catchall.domain")
+        alias_domain = self.env['ir.config_parameter'].sudo().get_param("mail.catchall.domain")
         res = dict.fromkeys(res_ids, False)
 
         # alias domain: check for aliases and catchall
@@ -768,7 +768,7 @@ class MailThread(models.AbstractModel):
             # left ids: use catchall
             left_ids = set(res_ids).difference(set(aliases.keys()))
             if left_ids:
-                catchall_alias = self.env['ir.config_parameter'].get_param("mail.catchall.alias")
+                catchall_alias = self.env['ir.config_parameter'].sudo().get_param("mail.catchall.alias")
                 if catchall_alias:
                     aliases.update(dict((res_id, '%s@%s' % (catchall_alias, alias_domain)) for res_id in left_ids))
             # compute name of reply-to
@@ -1012,7 +1012,7 @@ class MailThread(models.AbstractModel):
             raise TypeError('message must be an email.message.Message at this point')
         MailMessage = self.env['mail.message']
         Alias, dest_aliases = self.env['mail.alias'], self.env['mail.alias']
-        bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
+        bounce_alias = self.env['ir.config_parameter'].sudo().get_param("mail.bounce.alias")
         fallback_model = model
 
         # get email.message.Message variables for future processing
diff --git a/addons/mail/models/res_config.py b/addons/mail/models/res_config.py
index d34a6663a4f..f96ab82201c 100644
--- a/addons/mail/models/res_config.py
+++ b/addons/mail/models/res_config.py
@@ -37,4 +37,4 @@ class BaseConfiguration(models.TransientModel):
     @api.multi
     def set_alias_domain(self):
         for record in self:
-            self.env['ir.config_parameter'].set_param("mail.catchall.domain", record.alias_domain or '')
+            self.env['ir.config_parameter'].set_param("mail.catchall.domain", record.alias_domain or '', groups=['base.group_system'])
diff --git a/addons/mail/models/update.py b/addons/mail/models/update.py
index 7e2abfcbfd8..1bd09837552 100644
--- a/addons/mail/models/update.py
+++ b/addons/mail/models/update.py
@@ -113,9 +113,10 @@ class PublisherWarrantyContract(AbstractModel):
                     pass
             if result.get('enterprise_info'):
                 # Update expiration date
-                self.env['ir.config_parameter'].sudo().set_param('database.expiration_date', result['enterprise_info'].get('expiration_date'), ['base.group_user'])
-                self.env['ir.config_parameter'].sudo().set_param('database.expiration_reason', result['enterprise_info'].get('expiration_reason', 'trial'), ['base.group_system'])
-                self.env['ir.config_parameter'].sudo().set_param('database.enterprise_code', result['enterprise_info'].get('enterprise_code'), ['base.group_user'])
+                IrParamSudo = self.env['ir.config_parameter'].sudo()
+                IrParamSudo.set_param('database.expiration_date', result['enterprise_info'].get('expiration_date'), ['base.group_user'])
+                IrParamSudo.set_param('database.expiration_reason', result['enterprise_info'].get('expiration_reason', 'trial'), ['base.group_system'])
+                IrParamSudo.set_param('database.enterprise_code', result['enterprise_info'].get('enterprise_code'), ['base.group_user'])
 
         except Exception:
             if cron_mode:
diff --git a/addons/mass_mailing/models/mail_thread.py b/addons/mass_mailing/models/mail_thread.py
index 066dd285c79..8e515a664f8 100644
--- a/addons/mass_mailing/models/mail_thread.py
+++ b/addons/mass_mailing/models/mail_thread.py
@@ -17,7 +17,7 @@ class MailThread(models.AbstractModel):
     @api.model
     def message_route(self, message, message_dict, model=None, thread_id=None, custom_values=None):
         """ Override to udpate mass mailing statistics based on bounce emails """
-        bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
+        bounce_alias = self.env['ir.config_parameter'].sudo().get_param("mail.bounce.alias")
         email_to = decode_message_header(message, 'To')
         email_to_localpart = (tools.email_split(email_to) or [''])[0].split('@', 1)[0].lower()
 
diff --git a/addons/payment_paypal/models/payment.py b/addons/payment_paypal/models/payment.py
index 6aaff94a631..10d900ffb87 100644
--- a/addons/payment_paypal/models/payment.py
+++ b/addons/payment_paypal/models/payment.py
@@ -87,7 +87,7 @@ class AcquirerPaypal(models.Model):
 
     @api.multi
     def paypal_form_generate_values(self, values):
-        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
 
         paypal_tx_values = dict(values)
         paypal_tx_values.update({
diff --git a/addons/payment_sips/models/payment.py b/addons/payment_sips/models/payment.py
index e9cd4d40e6b..f3520db9665 100644
--- a/addons/payment_sips/models/payment.py
+++ b/addons/payment_sips/models/payment.py
@@ -69,7 +69,7 @@ class AcquirerSips(models.Model):
     @api.multi
     def sips_form_generate_values(self, values):
         self.ensure_one()
-        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
         currency = self.env['res.currency'].sudo().browse(values['currency_id'])
         currency_code = CURRENCY_CODES.get(currency.name, False)
         if not currency_code:
diff --git a/addons/rating/controllers/main.py b/addons/rating/controllers/main.py
index 48278b735a1..70259d6a74d 100644
--- a/addons/rating/controllers/main.py
+++ b/addons/rating/controllers/main.py
@@ -40,6 +40,6 @@ class Rating(http.Controller):
             return werkzeug.utils.redirect('/web#model=%s&id=%s&view_type=form' % (record_sudo._name, record_sudo.id))
         lang = rating.partner_id.lang or 'en_US'
         return request.env['ir.ui.view'].with_context(lang=lang).render_template('rating.rating_external_page_view', {
-            'web_base_url': request.env['ir.config_parameter'].sudo().get_param('web.base.url'),
+            'web_base_url': request.env['ir.config_parameter'].get_param('web.base.url'),
             'rating': rating,
         })
diff --git a/addons/report/models/ir_http.py b/addons/report/models/ir_http.py
index 61657a681d7..58c7e529edc 100644
--- a/addons/report/models/ir_http.py
+++ b/addons/report/models/ir_http.py
@@ -9,5 +9,5 @@ class IrHttp(models.AbstractModel):
 
     def session_info(self):
         res = super(IrHttp, self).session_info()
-        res['web.base.url'] = self.env['ir.config_parameter'].sudo().get_param('web.base.url', default='')
+        res['web.base.url'] = self.env['ir.config_parameter'].get_param('web.base.url', default='')
         return res
diff --git a/addons/website_forum/data/forum_data.xml b/addons/website_forum/data/forum_data.xml
index df39faa0371..eff8db88b14 100644
--- a/addons/website_forum/data/forum_data.xml
+++ b/addons/website_forum/data/forum_data.xml
@@ -13,7 +13,7 @@
         </record>
     </data>
     <data>
-        <function model="ir.config_parameter" name="set_param" eval="('auth_signup.allow_uninvited', True)" />
+        <function model="ir.config_parameter" name="set_param" eval="('auth_signup.allow_uninvited', True, ['base.group_system'])" />
 
         <!-- JUMP TO FORUM AT INSTALL -->
         <record id="action_open_forum" model="ir.actions.act_url">
diff --git a/addons/website_mail_channel/models/mail_channel.py b/addons/website_mail_channel/models/mail_channel.py
index 5cc8163c81c..57c5b22a311 100644
--- a/addons/website_mail_channel/models/mail_channel.py
+++ b/addons/website_mail_channel/models/mail_channel.py
@@ -34,7 +34,7 @@ class MailGroup(models.Model):
 
     @api.multi
     def _send_confirmation_email(self, partner_ids, unsubscribe=False):
-        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
         route = "/groups/%(action)s/%(channel)s/%(partner)s/%(token)s"
         if unsubscribe:
             template = self.env.ref('website_mail_channel.mail_template_list_unsubscribe')
diff --git a/odoo/addons/base/security/base_security.xml b/odoo/addons/base/security/base_security.xml
index 6bbc547c918..538892d9ba9 100644
--- a/odoo/addons/base/security/base_security.xml
+++ b/odoo/addons/base/security/base_security.xml
@@ -127,15 +127,15 @@
             <field name="domain_force">['|','|',('company_id.child_ids','child_of',[user.company_id.id]),('company_id','child_of',[user.company_id.id]),('company_id','=',False)]</field>
 	</record>
 
-    <record id="ir_config_parameter_rule" model="ir.rule">
-        <field name="name">ICP read rule</field>
-        <field name="model_id" ref="model_ir_config_parameter"/>
-        <field name="domain_force">['|',('group_ids','in', [g.id for g in user.groups_id]), ('group_ids','=',False)]</field>
-        <field name="perm_read" eval="True"/>
-        <field name="perm_create" eval="False"/>
-        <field name="perm_write" eval="False"/>
-        <field name="perm_unlink" eval="False"/>
-    </record>
+        <record id="ir_config_parameter_rule" model="ir.rule">
+            <field name="name">ICP read rule</field>
+            <field name="model_id" ref="model_ir_config_parameter"/>
+            <field name="domain_force">['|', ('group_ids','in',user.groups_id.ids), ('group_ids','=',False)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
 
         <record id="res_currency_rate_rule" model="ir.rule">
             <field name="name">multi-company currency rate rule</field>