[IMP] restrict modules to system_group

* listing of modules in website already bypassed session user
* altered authenticated endpoint so it does the same
* sudoed a few read accesses & name_get in groups
* other accesses are list/form views, menu only accessible to
  system_user
* new-API-ified some calls & unified listing of installed modules

4 files changed, 25 insertions, 37 deletions

diff --git a/addons/mail/models/update.py b/addons/mail/models/update.py
index e89dec14228..cd1f4054e8a 100644
--- a/addons/mail/models/update.py
+++ b/addons/mail/models/update.py
@@ -38,7 +38,7 @@ class publisher_warranty_contract(AbstractModel):
             nbr_active_share_users = user_count([("share", "=", True), ("login_date", ">=", limit_date_str)])
         user = Users.browse(cr, uid, uid)
         domain = [('application', '=', True), ('state', 'in', ['installed', 'to upgrade', 'to remove'])]
-        apps = self.pool['ir.module.module'].search_read(cr, uid, domain, ['name'])
+        apps = self.pool['ir.module.module'].search_read(cr, SUPERUSER_ID, domain, ['name'])
 
         web_base_url = get_param('web.base.url')
         msg = {
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 8d4553912b7..61bf1199a15 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -24,6 +24,8 @@ from cStringIO import StringIO
 import babel.messages.pofile
 import werkzeug.utils
 import werkzeug.wrappers
+from openerp.api import Environment
+
 try:
     import xlwt
 except ImportError:
@@ -144,47 +146,31 @@ def ensure_db(redirect='/web/database/selector'):
 
     request.session.db = db
 
-def module_installed():
+def module_installed(environment):
     # Candidates module the current heuristic is the /static dir
     loadable = http.addons_manifest.keys()
-    modules = {}
 
     # Retrieve database installed modules
     # TODO The following code should move to ir.module.module.list_installed_modules()
-    Modules = request.session.model('ir.module.module')
+    Modules = environment['ir.module.module']
     domain = [('state','=','installed'), ('name','in', loadable)]
-    for module in Modules.search_read(domain, ['name', 'dependencies_id']):
-        modules[module['name']] = []
-        deps = module.get('dependencies_id')
-        if deps:
-            deps_read = request.session.model('ir.module.module.dependency').read(deps, ['name'])
-            dependencies = [i['name'] for i in deps_read]
-            modules[module['name']] = dependencies
+    modules = {
+        module.name: module.dependencies_id.mapped('name')
+        for module in Modules.search(domain)
+    }
 
     sorted_modules = topological_sort(modules)
     return sorted_modules
 
 def module_installed_bypass_session(dbname):
-    loadable = http.addons_manifest.keys()
-    modules = {}
     try:
         registry = openerp.modules.registry.RegistryManager.get(dbname)
         with registry.cursor() as cr:
-            m = registry.get('ir.module.module')
-            # TODO The following code should move to ir.module.module.list_installed_modules()
-            domain = [('state','=','installed'), ('name','in', loadable)]
-            ids = m.search(cr, 1, [('state','=','installed'), ('name','in', loadable)])
-            for module in m.read(cr, 1, ids, ['name', 'dependencies_id']):
-                modules[module['name']] = []
-                deps = module.get('dependencies_id')
-                if deps:
-                    deps_read = registry.get('ir.module.module.dependency').read(cr, 1, deps, ['name'])
-                    dependencies = [i['name'] for i in deps_read]
-                    modules[module['name']] = dependencies
-    except Exception,e:
+            return module_installed(
+                environment=Environment(cr, openerp.SUPERUSER_ID, {}))
+    except Exception:
         pass
-    sorted_modules = topological_sort(modules)
-    return sorted_modules
+    return {}
 
 def module_boot(db=None):
     server_wide_modules = openerp.conf.server_wide_modules or ['web']
@@ -816,7 +802,7 @@ class Session(http.Controller):
     @http.route('/web/session/modules', type='json', auth="user")
     def modules(self):
         # return all installed modules. Web client is smart enough to not load a module twice
-        return module_installed()
+        return module_installed(environment=request.env(user=openerp.SUPERUSER_ID))
 
     @http.route('/web/session/save_session_action', type='json', auth="user")
     def save_session_action(self, the_action):
diff --git a/addons/web_planner/models/web_planner.py b/addons/web_planner/models/web_planner.py
index 6351f9d2ba3..2236486c0f1 100644
--- a/addons/web_planner/models/web_planner.py
+++ b/addons/web_planner/models/web_planner.py
@@ -62,12 +62,12 @@ class Planner(models.Model):
             params['model'] = 'ir.module.module'
         # setting the module
         if module_name:
-            module = self.env['ir.module.module'].search([('name', '=', module_name)], limit=1)
+            module = self.env['ir.module.module'].sudo().search([('name', '=', module_name)], limit=1)
             if module:
                 params['id'] = module.id
         return "/web#%s" % (urlencode(params),)
 
     @api.model
     def is_module_installed(self, module_name=None):
-        count = self.env['ir.module.module'].search_count([('state', '=', 'installed'), ('name', '=', module_name)])
+        count = self.env['ir.module.module'].sudo().search_count([('state', '=', 'installed'), ('name', '=', module_name)])
         return bool(count)
diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index c304ec1b04a..9a8797fafd8 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -216,10 +216,10 @@ class Website(openerp.addons.web.controllers.main.Home):
                 modules_to_update.append(view.model_data_id.module)
 
         if modules_to_update:
-            module_obj = request.registry['ir.module.module']
-            module_ids = module_obj.search(request.cr, request.uid, [('name', 'in', modules_to_update)], context=request.context)
-            if module_ids:
-                module_obj.button_immediate_upgrade(request.cr, request.uid, module_ids, context=request.context)
+            module_obj = request.env['ir.module.module'].sudo()
+            modules = module_obj.search([('name', 'in', modules_to_update)])
+            if modules:
+                modules.button_immediate_upgrade()
         return request.redirect(redirect)
 
     @http.route('/website/customize_template_get', type='json', auth='user', website=True)
@@ -235,9 +235,11 @@ class Website(openerp.addons.web.controllers.main.Home):
 
     @http.route('/website/translations', type='json', auth="public", website=True)
     def get_website_translations(self, lang, mods=None):
-        module_obj = request.registry['ir.module.module']
-        module_ids = module_obj.search(request.cr, request.uid, [('name', 'ilike', 'website'), ('state', '=', 'installed')], context=request.context)
-        modules = [x['name'] for x in module_obj.read(request.cr, request.uid, module_ids, ['name'], context=request.context)]
+        Modules = request.env['ir.module.module'].sudo()
+        modules = Modules.search([
+            ('name', 'ilike', 'website'),
+            ('state', '=', 'installed')
+        ]).mapped('name')
         if mods:
             modules += mods
         return WebClient().translations(mods=modules, lang=lang)