[FIX] *: add sudo when accessing views

The method fields_view_get should be the only way to retrieve the view
content. This method is executed in a super-user context.

To avoid retrieving views for a model a user does not have access to
(as it may reveal some informations like name of fields), add a
verification of 'read' rights before retrieving the view content.

Execute _postprocess_access_rights with sudo(False) as this method is
used to evaluate which buttons should be displayed.
Remove the su flag to avoid misleading the user and displaying a
button they won't be able to use.

Retrieving the database id from an view key is not considered as a
sensitive information and get_view_id and viewref can be left as a
public methods.

Add missing sudo when needed

Change _handle_visibility in website to avoid increasing the query
count: Checking the visibility (to fail most of the time) to retry in
sudo was making unecessary queries.

4 files changed, 9 insertions, 9 deletions

diff --git a/addons/web_editor/models/ir_qweb.py b/addons/web_editor/models/ir_qweb.py
index fdc5407e6f0..5eceda7855f 100644
--- a/addons/web_editor/models/ir_qweb.py
+++ b/addons/web_editor/models/ir_qweb.py
@@ -64,7 +64,7 @@ class QWeb(models.AbstractModel):
         key = el.attrib.pop('t-snippet')
         el.set('t-call', key)
         el.set('t-call-options', "{'snippet-key': '" + key + "'}")
-        View = self.env['ir.ui.view']
+        View = self.env['ir.ui.view'].sudo()
         view_id = View.get_view_id(key)
         name = View.browse(view_id).name
         thumbnail = el.attrib.pop('t-thumbnail', "oe-thumbnail")
diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index c4e0e20675a..93d44718b9b 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -340,7 +340,10 @@ class Website(Home):
 
     @http.route('/website/toggle_switchable_view', type='json', auth='user', website=True)
     def toggle_switchable_view(self, view_key):
-        request.website.viewref(view_key).toggle_active()
+        if request.website.user_has_groups('website.group_website_designer'):
+            request.website.viewref(view_key).toggle_active()
+        else:
+            return werkzeug.exceptions.Forbidden()
 
     @http.route('/website/reset_template', type='http', auth='user', methods=['POST'], website=True, csrf=False)
     def reset_template(self, view_id, mode='soft', redirect='/', **kwargs):
diff --git a/addons/website/models/ir_ui_view.py b/addons/website/models/ir_ui_view.py
index 7f670a81a46..12d2831c0d8 100644
--- a/addons/website/models/ir_ui_view.py
+++ b/addons/website/models/ir_ui_view.py
@@ -359,10 +359,7 @@ class View(models.Model):
         """
         error = False
 
-        try:
-            self.visibility  # avoid useless sudo() in case page is public
-        except AccessError:
-            self = self.sudo()
+        self = self.sudo()
 
         if self.visibility and not request.env.user.has_group('website.group_website_designer'):
             if (self.visibility == 'connected' and request.website.is_public_user()):
diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index d230000c23f..c0c65070311 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -670,7 +670,7 @@ class Website(models.Model):
             :param raise_if_not_found: should the method raise an error if no view found
             :return: The view record or empty recordset
         '''
-        View = self.env['ir.ui.view']
+        View = self.env['ir.ui.view'].sudo()
         view = View
         if isinstance(view_id, str):
             if 'website_id' in self._context:
@@ -700,7 +700,7 @@ class Website(models.Model):
 
     @tools.ormcache_context(keys=('website_id',))
     def _cache_customize_show_views(self):
-        views = self.env['ir.ui.view'].with_context(active_test=False).search([('customize_show', '=', True)])
+        views = self.env['ir.ui.view'].with_context(active_test=False).sudo().search([('customize_show', '=', True)])
         views = views.filter_duplicate()
         return {v.key: v.active for v in views}
 
@@ -862,7 +862,7 @@ class Website(models.Model):
 
     def get_website_pages(self, domain=[], order='name', limit=None):
         domain += self.get_current_website().website_domain()
-        pages = self.env['website.page'].search(domain, order=order, limit=limit)
+        pages = self.env['website.page'].sudo().search(domain, order=order, limit=limit)
         return pages
 
     def search_pages(self, needle=None, limit=None):