[MERGE] base: tighten access rights of ir.* models

2 files changed, 15 insertions, 13 deletions

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index b1d5c732a13..930a8233eb5 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -18,6 +18,7 @@ import os
 import re
 import sys
 import time
+import werkzeug
 import werkzeug.utils
 import werkzeug.wrappers
 import zlib
@@ -777,6 +778,17 @@ class Session(http.Controller):
         request.session.check_security()
         return None
 
+    @http.route('/web/session/account', type='json', auth="user")
+    def account(self):
+        ICP = request.env['ir.config_parameter'].sudo()
+        params = {
+            'response_type': 'token',
+            'client_id': ICP.get_param('database.uuid') or '',
+            'state': json.dumps({'d': request.db, 'u': ICP.get_param('web.base.url')}),
+            'scope': 'userinfo',
+        }
+        return 'https://accounts.odoo.com/oauth2/auth?' + werkzeug.url_encode(params)
+
     @http.route('/web/session/destroy', type='json', auth="user")
     def destroy(self):
         request.session.logout()
diff --git a/addons/web/static/src/js/widgets/user_menu.js b/addons/web/static/src/js/widgets/user_menu.js
index 3c65ab3ac49..d1cd0eb842b 100644
--- a/addons/web/static/src/js/widgets/user_menu.js
+++ b/addons/web/static/src/js/widgets/user_menu.js
@@ -58,21 +58,11 @@ var UserMenu = Widget.extend({
         });
     },
     on_menu_account: function() {
+        var self = this;
         this.trigger_up('clear_uncommitted_changes', {
             callback: function() {
-                var P = new Model('ir.config_parameter');
-                P.call('get_param', ['database.uuid']).then(function(dbuuid) {
-                    var state = {
-                        'd': session.db,
-                        'u': window.location.protocol + '//' + window.location.host,
-                    };
-                    var params = {
-                        response_type: 'token',
-                        client_id: dbuuid || '',
-                        state: JSON.stringify(state),
-                        scope: 'userinfo',
-                    };
-                    framework.redirect('https://accounts.odoo.com/oauth2/auth?'+$.param(params));
+                self.rpc('/web/session/account').then(function(url) {
+                    framework.redirect(url);
                 }).fail(function(result, ev){
                     ev.preventDefault();
                     framework.redirect('https://accounts.odoo.com/account');