[IMP] base, *: tighten `ir.model` access rights

Remove unrestricted "read" access.  To make code internally using `ir.model`
work, add a private method `_get` on `ir.model` to retrieve the record
corresponding to a model name, without access rights issue.

Change signature of method `get_authorized_fields` to make it use a model name
instead of a model id.  This removes the necessity of a search on `ir.model`.

1 files changed, 5 insertions, 4 deletions

diff --git a/addons/website_form/models/models.py b/addons/website_form/models/models.py
index 16aba290a2a..f1a80abbb68 100644
--- a/addons/website_form/models/models.py
+++ b/addons/website_form/models/models.py
@@ -41,13 +41,14 @@ class website_form_model(models.Model):
             ])
         }
         return {
-            k: v for k, v in self.get_authorized_fields().iteritems()
+            k: v for k, v in self.get_authorized_fields(self.model).iteritems()
             if k not in excluded
         }
 
-    @api.multi
-    def get_authorized_fields(self):
-        model = self.env[self.model]
+    @api.model
+    def get_authorized_fields(self, model_name):
+        """ Return the fields of the given model name as a mapping like method `fields_get`. """
+        model = self.env[model_name]
         fields_get = model.fields_get()
 
         for key, val in model._inherits.iteritems():