[MERGE] base: tighten access rights of ir.* models

74 files changed, 181 insertions, 214 deletions

diff --git a/addons/account/models/chart_template.py b/addons/account/models/chart_template.py
index c228eb5f604..2f5f40df280 100644
--- a/addons/account/models/chart_template.py
+++ b/addons/account/models/chart_template.py
@@ -226,7 +226,7 @@ class AccountChartTemplate(models.Model):
             account = getattr(self, record[0])
             value = account and 'account.account,' + str(acc_template_ref[account.id]) or False
             if value:
-                field = self.env['ir.model.fields'].search([('name', '=', record[0]), ('model', '=', record[1]), ('relation', '=', record[2])], limit=1)
+                field = self.env['ir.model.fields'].sudo().search([('name', '=', record[0]), ('model', '=', record[1]), ('relation', '=', record[2])])
                 vals = {
                     'name': record[0],
                     'company_id': company.id,
diff --git a/addons/anonymization/models/anonymization.py b/addons/anonymization/models/anonymization.py
index 06ffcf92216..9819ba6b26e 100644
--- a/addons/anonymization/models/anonymization.py
+++ b/addons/anonymization/models/anonymization.py
@@ -59,11 +59,8 @@ class IrModelFieldsAnonymization(models.Model):
     @api.model
     def _get_model_and_field_ids(self, vals):
         if vals.get('field_name') and vals.get('model_name'):
-            model_id = self.env['ir.model'].search([('model', '=', vals['model_name'])], limit=1).id
-            if model_id:
-                field_id = self.env['ir.model.fields'].search([('name', '=', vals['field_name']), ('model_id', '=', model_id)], limit=1).id
-                if field_id:
-                    return (model_id, field_id)
+            field = self.env['ir.model.fields']._get(vals['model_name'], vals['field_name'])
+            return (field.model_id.id, field.id)
         return (False, False)
 
     @api.model
@@ -109,17 +106,12 @@ class IrModelFieldsAnonymization(models.Model):
     def _onchange_model_name(self):
         self.field_name = False
         self.field_id = False
-        if self.model_name:
-            self.model_id = self.env['ir.model'].search([('model', '=', self.model_name)], limit=1)
-        else:
-            self.model_id = False
+        self.model_id = self.env['ir.model']._get(self.model_name)
 
     @api.onchange('field_name')
     def _onchange_field_name(self):
         if self.field_name and self.model_name:
-            self.field_id = self.env['ir.model.fields'].search([
-                ('name', '=', self.field_name), ('model', '=', self.model_name)
-            ], limit=1)
+            self.field_id = self.env['ir.model.fields']._get(self.model_name, self.field_name)
         else:
             self.field_id = False
 
diff --git a/addons/auth_signup/controllers/main.py b/addons/auth_signup/controllers/main.py
index 2718e47dd2a..804642ac8c2 100644
--- a/addons/auth_signup/controllers/main.py
+++ b/addons/auth_signup/controllers/main.py
@@ -70,10 +70,10 @@ class AuthSignupHome(Home):
     def get_auth_signup_config(self):
         """retrieve the module config (which features are enabled) for the login page"""
 
-        IrConfigParam = request.env['ir.config_parameter']
+        get_param = request.env['ir.config_parameter'].sudo().get_param
         return {
-            'signup_enabled': IrConfigParam.sudo().get_param('auth_signup.allow_uninvited') == 'True',
-            'reset_password_enabled': IrConfigParam.sudo().get_param('auth_signup.reset_password') == 'True',
+            'signup_enabled': get_param('auth_signup.allow_uninvited') == 'True',
+            'reset_password_enabled': get_param('auth_signup.reset_password') == 'True',
         }
 
     def get_auth_signup_qcontext(self):
diff --git a/addons/auth_signup/models/res_config.py b/addons/auth_signup/models/res_config.py
index bfb89e76d3d..d6bf82a1d05 100644
--- a/addons/auth_signup/models/res_config.py
+++ b/addons/auth_signup/models/res_config.py
@@ -13,19 +13,19 @@ class BaseConfigSettings(models.TransientModel):
 
     @api.model
     def get_default_auth_signup_template_user_id(self, fields):
-        IrConfigParam = self.env['ir.config_parameter']
+        get_param = self.env['ir.config_parameter'].get_param
         # we use safe_eval on the result, since the value of the parameter is a nonempty string
         return {
-            'auth_signup_reset_password': safe_eval(IrConfigParam.get_param('auth_signup.reset_password', 'False')),
-            'auth_signup_uninvited': safe_eval(IrConfigParam.get_param('auth_signup.allow_uninvited', 'False')),
-            'auth_signup_template_user_id': safe_eval(IrConfigParam.get_param('auth_signup.template_user_id', 'False')),
+            'auth_signup_reset_password': safe_eval(get_param('auth_signup.reset_password', 'False')),
+            'auth_signup_uninvited': safe_eval(get_param('auth_signup.allow_uninvited', 'False')),
+            'auth_signup_template_user_id': safe_eval(get_param('auth_signup.template_user_id', 'False')),
         }
 
     @api.multi
     def set_auth_signup_template_user_id(self):
         self.ensure_one()
-        IrConfigParam = self.env['ir.config_parameter']
+        set_param = self.env['ir.config_parameter'].set_param
         # we store the repr of the values, since the value of the parameter is a required string
-        IrConfigParam.set_param('auth_signup.reset_password', repr(self.auth_signup_reset_password))
-        IrConfigParam.set_param('auth_signup.allow_uninvited', repr(self.auth_signup_uninvited))
-        IrConfigParam.set_param('auth_signup.template_user_id', repr(self.auth_signup_template_user_id.id))
+        set_param('auth_signup.reset_password', repr(self.auth_signup_reset_password))
+        set_param('auth_signup.allow_uninvited', repr(self.auth_signup_uninvited))
+        set_param('auth_signup.template_user_id', repr(self.auth_signup_template_user_id.id))
diff --git a/addons/auth_signup/models/res_partner.py b/addons/auth_signup/models/res_partner.py
index d2bad560398..6dbf14188d8 100644
--- a/addons/auth_signup/models/res_partner.py
+++ b/addons/auth_signup/models/res_partner.py
@@ -52,7 +52,7 @@ class ResPartner(models.Model):
             the url state components (menu_id, id, view_type) """
 
         res = dict.fromkeys(self.ids, False)
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for partner in self:
             # when required, make sure the partner has a valid signup token
             if self.env.context.get('signup_valid') and not partner.user_ids:
diff --git a/addons/auth_signup/models/res_users.py b/addons/auth_signup/models/res_users.py
index c82a35792a2..a0871c35fa8 100644
--- a/addons/auth_signup/models/res_users.py
+++ b/addons/auth_signup/models/res_users.py
@@ -75,14 +75,14 @@ class ResUsers(models.Model):
     @api.model
     def _signup_create_user(self, values):
         """ create a new user from the template user """
-        IrConfigParam = self.env['ir.config_parameter']
-        template_user_id = literal_eval(IrConfigParam.get_param('auth_signup.template_user_id', 'False'))
+        get_param = self.env['ir.config_parameter'].sudo().get_param
+        template_user_id = literal_eval(get_param('auth_signup.template_user_id', 'False'))
         template_user = self.browse(template_user_id)
         assert template_user.exists(), 'Signup: invalid template user'
 
         # check that uninvited users may sign up
         if 'partner_id' not in values:
-            if not literal_eval(IrConfigParam.get_param('auth_signup.allow_uninvited', 'False')):
+            if not literal_eval(get_param('auth_signup.allow_uninvited', 'False')):
                 raise SignupError('Signup is not allowed for uninvited users')
 
         assert values.get('login'), "Signup: no login given for new user"
diff --git a/addons/base_gengo/wizard/base_gengo_translations.py b/addons/base_gengo/wizard/base_gengo_translations.py
index 9e1f06a264f..e75f88eace5 100644
--- a/addons/base_gengo/wizard/base_gengo_translations.py
+++ b/addons/base_gengo/wizard/base_gengo_translations.py
@@ -47,8 +47,8 @@ class BaseGengoTranslations(models.TransientModel):
     @api.model_cr
     def init(self):
         icp = self.env['ir.config_parameter'].sudo()
-        if not icp.get_param(self.GENGO_KEY, default=None):
-            icp.set_param(self.GENGO_KEY, str(uuid.uuid4()), groups=self.GROUPS)
+        if not icp.get_param(self.GENGO_KEY):
+            icp.set_param(self.GENGO_KEY, str(uuid.uuid4()))
 
     @api.model_cr
     def get_gengo_key(self):
@@ -206,7 +206,7 @@ class BaseGengoTranslations(models.TransientModel):
                 'term2.id': {...}
                 }
             }'''
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         IrTranslation = self.env['ir.translation']
         jobs = {}
         user = self.env.user
diff --git a/addons/calendar/models/calendar.py b/addons/calendar/models/calendar.py
index 0e3ee80bf1c..ab1c7f19309 100644
--- a/addons/calendar/models/calendar.py
+++ b/addons/calendar/models/calendar.py
@@ -131,7 +131,7 @@ class Attendee(models.Model):
         """
         res = False
 
-        if self.env['ir.config_parameter'].get_param('calendar.block_mail') or self._context.get("no_mail_to_attendees"):
+        if self.env['ir.config_parameter'].sudo().get_param('calendar.block_mail') or self._context.get("no_mail_to_attendees"):
             return res
 
         calendar_view = self.env.ref('calendar.view_calendar_event_calendar')
@@ -152,7 +152,7 @@ class Attendee(models.Model):
             'color': colors,
             'action_id': self.env['ir.actions.act_window'].search([('view_id', '=', calendar_view.id)], limit=1).id,
             'dbname': self._cr.dbname,
-            'base_url': self.env['ir.config_parameter'].get_param('web.base.url', default='http://localhost:8069')
+            'base_url': self.env['ir.config_parameter'].sudo().get_param('web.base.url', default='http://localhost:8069')
         })
         invitation_template = invitation_template.with_context(rendering_context)
 
diff --git a/addons/crm/models/res_config.py b/addons/crm/models/res_config.py
index 295dbaca25a..e30b7b16fd1 100644
--- a/addons/crm/models/res_config.py
+++ b/addons/crm/models/res_config.py
@@ -10,7 +10,7 @@ class CRMSettings(models.TransientModel):
     generate_sales_team_alias = fields.Boolean("Automatically generate an email alias at the sales team creation",
         help="Odoo will generate an email alias based on the sales team name")
     alias_prefix = fields.Char('Default Alias Name for Leads')
-    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
     default_generate_lead_from_alias = fields.Boolean(default_model='sale.config.settings')
     group_use_lead = fields.Boolean(string="Leads", implied_group='crm.group_use_lead')
     module_crm_voip = fields.Boolean("Asterisk (VoIP)")
diff --git a/addons/crm/wizard/base_partner_merge.py b/addons/crm/wizard/base_partner_merge.py
index 44320807797..4eac5798645 100644
--- a/addons/crm/wizard/base_partner_merge.py
+++ b/addons/crm/wizard/base_partner_merge.py
@@ -233,8 +233,8 @@ class MergePartnerAutomatic(models.TransientModel):
             update_records('marketing.campaign.workitem', src=partner, field_model='object_id.model')
             update_records('ir.model.data', src=partner)
 
-        records = self.env['ir.model.fields'].search([('ttype', '=', 'reference')])
-        for record in records.sudo():
+        records = self.env['ir.model.fields'].sudo().search([('ttype', '=', 'reference')])
+        for record in records:
             try:
                 Model = self.env[record.model]
                 field = Model._fields[record.name]
@@ -250,7 +250,7 @@ class MergePartnerAutomatic(models.TransientModel):
                 values = {
                     record.name: 'res.partner,%d' % dst_partner.id,
                 }
-                records_ref.sudo().write(values)
+                records_ref.write(values)
 
     @api.model
     def _update_values(self, src_partners, dst_partner):
diff --git a/addons/google_account/models/google_service.py b/addons/google_account/models/google_service.py
index d707ee8d188..07fa2d12cf5 100644
--- a/addons/google_account/models/google_service.py
+++ b/addons/google_account/models/google_service.py
@@ -57,11 +57,11 @@ class GoogleService(models.TransientModel):
 
     @api.model
     def _get_google_token_uri(self, service, scope):
-        Parameters = self.env['ir.config_parameter'].sudo()
+        get_param = self.env['ir.config_parameter'].sudo().get_param
         encoded_params = werkzeug.url_encode({
             'scope': scope,
-            'redirect_uri': Parameters.get_param('google_redirect_uri'),
-            'client_id': Parameters.get_param('google_%s_client_id' % service),
+            'redirect_uri': get_param('google_redirect_uri'),
+            'client_id': get_param('google_%s_client_id' % service),
             'response_type': 'code',
         })
         return '%s?%s' % (GOOGLE_AUTH_ENDPOINT, encoded_params)
@@ -77,9 +77,9 @@ class GoogleService(models.TransientModel):
             'f': from_url
         }
 
-        Parameters = self.env['ir.config_parameter']
-        base_url = Parameters.get_param('web.base.url', default='http://www.odoo.com?NoBaseUrl')
-        client_id = Parameters.sudo().get_param('google_%s_client_id' % (service,), default=False)
+        get_param = self.env['ir.config_parameter'].sudo().get_param
+        base_url = get_param('web.base.url', default='http://www.odoo.com?NoBaseUrl')
+        client_id = get_param('google_%s_client_id' % (service,), default=False)
 
         encoded_params = werkzeug.url_encode({
             'response_type': 'code',
@@ -97,10 +97,10 @@ class GoogleService(models.TransientModel):
         """ Call Google API to exchange authorization code against token, with POST request, to
             not be redirected.
         """
-        Parameters = self.env['ir.config_parameter']
-        base_url = Parameters.get_param('web.base.url', default='http://www.odoo.com?NoBaseUrl')
-        client_id = Parameters.sudo().get_param('google_%s_client_id' % (service,), default=False)
-        client_secret = Parameters.sudo().get_param('google_%s_client_secret' % (service,), default=False)
+        get_param = self.env['ir.config_parameter'].sudo().get_param
+        base_url = get_param('web.base.url', default='http://www.odoo.com?NoBaseUrl')
+        client_id = get_param('google_%s_client_id' % (service,), default=False)
+        client_secret = get_param('google_%s_client_secret' % (service,), default=False)
 
         headers = {"content-type": "application/x-www-form-urlencoded"}
         data = werkzeug.url_encode({
@@ -120,9 +120,9 @@ class GoogleService(models.TransientModel):
     # FIXME : this method update a field defined in google_calendar module. Since it is used only in that module, maybe it should be moved.
     @api.model
     def _refresh_google_token_json(self, refresh_token, service):  # exchange_AUTHORIZATION vs Token (service = calendar)
-        Parameters = self.env['ir.config_parameter'].sudo()
-        client_id = Parameters.get_param('google_%s_client_id' % (service,), default=False)
-        client_secret = Parameters.get_param('google_%s_client_secret' % (service,), default=False)
+        get_param = self.env['ir.config_parameter'].sudo().get_param
+        client_id = get_param('google_%s_client_id' % (service,), default=False)
+        client_secret = get_param('google_%s_client_secret' % (service,), default=False)
 
         headers = {"content-type": "application/x-www-form-urlencoded"}
         data = werkzeug.url_encode({
diff --git a/addons/google_calendar/models/google_calendar.py b/addons/google_calendar/models/google_calendar.py
index 965479ef2d6..7a5fda8575e 100644
--- a/addons/google_calendar/models/google_calendar.py
+++ b/addons/google_calendar/models/google_calendar.py
@@ -906,14 +906,14 @@ class GoogleCalendar(models.AbstractModel):
         self.env.user.sudo().write(vals)
 
     def get_minTime(self):
-        number_of_week = self.env['ir.config_parameter'].get_param('calendar.week_synchro', default=13)
+        number_of_week = self.env['ir.config_parameter'].sudo().get_param('calendar.week_synchro', default=13)
         return datetime.now() - timedelta(weeks=number_of_week)
 
     def get_need_synchro_attendee(self):
-        return self.env['ir.config_parameter'].get_param('calendar.block_synchro_attendee', default=True)
+        return self.env['ir.config_parameter'].sudo().get_param('calendar.block_synchro_attendee', default=True)
 
     def get_disable_since_synchro(self):
-        return self.env['ir.config_parameter'].get_param('calendar.block_since_synchro', default=False)
+        return self.env['ir.config_parameter'].sudo().get_param('calendar.block_since_synchro', default=False)
 
     def get_print_log(self):
-        return self.env['ir.config_parameter'].get_param('calendar.debug_print', default=False)
+        return self.env['ir.config_parameter'].sudo().get_param('calendar.debug_print', default=False)
diff --git a/addons/google_calendar/models/res_config.py b/addons/google_calendar/models/res_config.py
index f1d93ad4046..400a15480d8 100644
--- a/addons/google_calendar/models/res_config.py
+++ b/addons/google_calendar/models/res_config.py
@@ -14,11 +14,13 @@ class CalendarSettings(models.TransientModel):
     server_uri = fields.Char('URI for tuto')
 
     def set_calset(self):
-        self.env['ir.config_parameter'].set_param('google_calendar_client_id', (self.cal_client_id or '').strip(), groups=['base.group_system'])
-        self.env['ir.config_parameter'].set_param('google_calendar_client_secret', (self.cal_client_secret or '').strip(), groups=['base.group_system'])
+        set_param = self.env['ir.config_parameter'].set_param
+        set_param('google_calendar_client_id', (self.cal_client_id or '').strip())
+        set_param('google_calendar_client_secret', (self.cal_client_secret or '').strip())
 
     def get_default_all(self, fields):
-        cal_client_id = self.env['ir.config_parameter'].get_param('google_calendar_client_id', default='')
-        cal_client_secret = self.env['ir.config_parameter'].get_param('google_calendar_client_secret', default='')
-        server_uri = "%s/google_account/authentication" % self.env['ir.config_parameter'].get_param('web.base.url', default="http://yourcompany.odoo.com")
+        get_param = self.env['ir.config_parameter'].get_param
+        cal_client_id = get_param('google_calendar_client_id', default='')
+        cal_client_secret = get_param('google_calendar_client_secret', default='')
+        server_uri = "%s/google_account/authentication" % get_param('web.base.url', default="http://yourcompany.odoo.com")
         return dict(cal_client_id=cal_client_id, cal_client_secret=cal_client_secret, server_uri=server_uri)
diff --git a/addons/google_drive/data/google_drive_data.xml b/addons/google_drive/data/google_drive_data.xml
index 3637c50caaa..2da9e8185c0 100644
--- a/addons/google_drive/data/google_drive_data.xml
+++ b/addons/google_drive/data/google_drive_data.xml
@@ -5,13 +5,11 @@
          <record id="config_google_drive_client_id" model="ir.config_parameter">
             <field name="key">google_drive_client_id</field>
             <field name="value">598905559630.apps.googleusercontent.com</field>
-            <field name="group_ids" eval="[(4, ref('base.group_system'))]" />
         </record>
 
         <record id="config_google_drive_client_secret" model="ir.config_parameter">
             <field name="key">google_drive_client_secret</field>
             <field name="value">vTmou73c-njP-1qCxm7qx7QE</field>
-            <field name="group_ids" eval="[(4, ref('base.group_system'))]" />
         </record>
 
     </data>
diff --git a/addons/google_drive/models/google_drive.py b/addons/google_drive/models/google_drive.py
index 0a65ffb175e..b1eda64b842 100644
--- a/addons/google_drive/models/google_drive.py
+++ b/addons/google_drive/models/google_drive.py
@@ -49,8 +49,8 @@ class GoogleDrive(models.Model):
 
     @api.model
     def get_access_token(self, scope=None):
-        Config = self.env['ir.config_parameter']
-        google_drive_refresh_token = Config.sudo().get_param('google_drive_refresh_token')
+        Config = self.env['ir.config_parameter'].sudo()
+        google_drive_refresh_token = Config.get_param('google_drive_refresh_token')
         user_is_admin = self.env['res.users'].browse(self.env.user.id)._is_admin()
         if not google_drive_refresh_token:
             if user_is_admin:
@@ -59,8 +59,8 @@ class GoogleDrive(models.Model):
                 raise RedirectWarning(msg, action_id, _('Go to the configuration panel'))
             else:
                 raise UserError(_("Google Drive is not yet configured. Please contact your administrator."))
-        google_drive_client_id = Config.sudo().get_param('google_drive_client_id')
-        google_drive_client_secret = Config.sudo().get_param('google_drive_client_secret')
+        google_drive_client_id = Config.get_param('google_drive_client_id')
+        google_drive_client_secret = Config.get_param('google_drive_client_secret')
         #For Getting New Access Token With help of old Refresh Token
         data = werkzeug.url_encode({
             'client_id': google_drive_client_id,
diff --git a/addons/google_drive/models/res_config.py b/addons/google_drive/models/res_config.py
index be3aca5cb01..fba3f8ec9f1 100644
--- a/addons/google_drive/models/res_config.py
+++ b/addons/google_drive/models/res_config.py
@@ -29,5 +29,5 @@ class BaseConfigSettings(models.TransientModel):
         if authorization_code and authorization_code != ICP.get_param('google_drive_authorization_code'):
             refresh_token = self.env['google.service'].generate_refresh_token('drive', authorization_code)
 
-        ICP.set_param('google_drive_authorization_code', authorization_code, groups=['base.group_system'])
-        ICP.set_param('google_drive_refresh_token', refresh_token, groups=['base.group_system'])
+        ICP.set_param('google_drive_authorization_code', authorization_code)
+        ICP.set_param('google_drive_refresh_token', refresh_token)
diff --git a/addons/google_spreadsheet/models/google_drive.py b/addons/google_spreadsheet/models/google_drive.py
index be03444cb1c..88b75a65ca3 100644
--- a/addons/google_spreadsheet/models/google_drive.py
+++ b/addons/google_spreadsheet/models/google_drive.py
@@ -40,7 +40,7 @@ class GoogleDrive(models.Model):
             formula = '=oe_read_group("%s";"%s";"%s";"%s")' % (model, fields, groupbys, domain)
         else:
             formula = '=oe_browse("%s";"%s";"%s")' % (model, fields, domain)
-        url = self.env['ir.config_parameter'].get_param('web.base.url')
+        url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         dbname = self._cr.dbname
         user = self.env['res.users'].browse(self.env.user.id).read(['login', 'password'])[0]
         username = user['login']
diff --git a/addons/hr_expense/models/res_config.py b/addons/hr_expense/models/res_config.py
index c1eda4f459b..27320517cf4 100644
--- a/addons/hr_expense/models/res_config.py
+++ b/addons/hr_expense/models/res_config.py
@@ -7,7 +7,7 @@ class HrExpenseConfigSettings(models.TransientModel):
     _inherit = 'res.config.settings'
 
     alias_prefix = fields.Char('Default Alias Name for Expenses')
-    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+    alias_domain = fields.Char('Alias Domain', default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
 
     @api.model
     def get_default_alias_prefix(self, fields):
diff --git a/addons/im_livechat/models/im_livechat_channel.py b/addons/im_livechat/models/im_livechat_channel.py
index 2041697bd03..c2f0e8cb3c2 100644
--- a/addons/im_livechat/models/im_livechat_channel.py
+++ b/addons/im_livechat/models/im_livechat_channel.py
@@ -195,7 +195,7 @@ class ImLivechatChannel(models.Model):
     def get_livechat_info(self, channel_id, username='Visitor'):
         info = {}
         info['available'] = len(self.browse(channel_id).get_available_users()) > 0
-        info['server_url'] = self.env['ir.config_parameter'].get_param('web.base.url')
+        info['server_url'] = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         if info['available']:
             info['options'] = self.sudo().get_channel_infos(channel_id)
             info['options']["default_username"] = username
diff --git a/addons/link_tracker/models/link_tracker.py b/addons/link_tracker/models/link_tracker.py
index 7b30151ca66..ce6d3b41b84 100644
--- a/addons/link_tracker/models/link_tracker.py
+++ b/addons/link_tracker/models/link_tracker.py
@@ -51,7 +51,7 @@ class link_tracker(models.Model):
     def convert_links(self, html, vals, blacklist=None):
         for match in re.findall(URL_REGEX, html):
 
-            short_schema = self.env['ir.config_parameter'].get_param('web.base.url') + '/r/'
+            short_schema = self.env['ir.config_parameter'].sudo().get_param('web.base.url') + '/r/'
 
             href = match[0]
             long_url = match[1]
@@ -76,12 +76,12 @@ class link_tracker(models.Model):
     @api.one
     @api.depends('code')
     def _compute_short_url(self):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         self.short_url = urljoin(base_url, '/r/%(code)s' % {'code': self.code})
 
     @api.one
     def _compute_short_url_host(self):
-        self.short_url_host = self.env['ir.config_parameter'].get_param('web.base.url') + '/r/'
+        self.short_url_host = self.env['ir.config_parameter'].sudo().get_param('web.base.url') + '/r/'
 
     @api.one
     def _compute_code(self):
diff --git a/addons/mail/models/mail_alias.py b/addons/mail/models/mail_alias.py
index 6acf894c996..07d6bfb3d58 100644
--- a/addons/mail/models/mail_alias.py
+++ b/addons/mail/models/mail_alias.py
@@ -63,7 +63,7 @@ class Alias(models.Model):
         help="Optional ID of a thread (record) to which all incoming messages will be attached, even "
              "if they did not reply to it. If set, this will disable the creation of new records completely.")
     alias_domain = fields.Char('Alias domain', compute='_get_alias_domain',
-                               default=lambda self: self.env["ir.config_parameter"].get_param("mail.catchall.domain"))
+                               default=lambda self: self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain"))
     alias_parent_model_id = fields.Many2one(
         'ir.model', 'Parent Model',
         help="Parent model holding the alias. The model holding the alias reference "
@@ -86,7 +86,7 @@ class Alias(models.Model):
 
     @api.multi
     def _get_alias_domain(self):
-        alias_domain = self.env["ir.config_parameter"].get_param("mail.catchall.domain")
+        alias_domain = self.env["ir.config_parameter"].sudo().get_param("mail.catchall.domain")
         for record in self:
             record.alias_domain = alias_domain
 
@@ -111,10 +111,10 @@ class Alias(models.Model):
         if vals.get('alias_name'):
             vals['alias_name'] = self._clean_and_make_unique(vals.get('alias_name'))
         if model_name:
-            model = self.env['ir.model'].search([('model', '=', model_name)])
+            model = self.env['ir.model']._get(model_name)
             vals['alias_model_id'] = model.id
         if parent_model_name:
-            model = self.env['ir.model'].search([('model', '=', parent_model_name)])
+            model = self.env['ir.model']._get(parent_model_name)
             vals['alias_parent_model_id'] = model.id
         return super(Alias, self).create(vals)
 
diff --git a/addons/mail/models/mail_followers.py b/addons/mail/models/mail_followers.py
index 9187917643a..825053f4e36 100644
--- a/addons/mail/models/mail_followers.py
+++ b/addons/mail/models/mail_followers.py
@@ -40,7 +40,7 @@ class Followers(models.Model):
         :param force: if True, delete existing followers before creating new one
                       using the subtypes given in the parameters
         """
-        res_model_id = self.env['ir.model'].search([('model', '=', res_model)], limit=1).id
+        res_model_id = self.env['ir.model']._get(res_model).id
         force_mode = force or (all(data for data in partner_data.values()) and all(data for data in channel_data.values()))
         generic = []
         specific = {}
diff --git a/addons/mail/models/mail_mail.py b/addons/mail/models/mail_mail.py
index 26fe8e052e4..04d9fedde24 100644
--- a/addons/mail/models/mail_mail.py
+++ b/addons/mail/models/mail_mail.py
@@ -212,7 +212,7 @@ class MailMail(models.Model):
             try:
                 # TDE note: remove me when model_id field is present on mail.message - done here to avoid doing it multiple times in the sub method
                 if mail.model:
-                    model = self.env['ir.model'].sudo().search([('model', '=', mail.model)])[0]
+                    model = self.env['ir.model']._get(mail.model)[0]
                 else:
                     model = None
                 if model:
@@ -233,8 +233,9 @@ class MailMail(models.Model):
 
                 # headers
                 headers = {}
-                bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
-                catchall_domain = self.env['ir.config_parameter'].get_param("mail.catchall.domain")
+                ICP = self.env['ir.config_parameter'].sudo()
+                bounce_alias = ICP.get_param("mail.bounce.alias")
+                catchall_domain = ICP.get_param("mail.catchall.domain")
                 if bounce_alias and catchall_domain:
                     if mail.model and mail.res_id:
                         headers['Return-Path'] = '%s+%d-%s-%d@%s' % (bounce_alias, mail.id, mail.model, mail.res_id, catchall_domain)
diff --git a/addons/mail/models/mail_template.py b/addons/mail/models/mail_template.py
index 9f870b86ac2..b4e66e71f33 100644
--- a/addons/mail/models/mail_template.py
+++ b/addons/mail/models/mail_template.py
@@ -106,7 +106,7 @@ class MailTemplate(models.Model):
     def default_get(self, fields):
         res = super(MailTemplate, self).default_get(fields)
         if res.get('model'):
-            res['model_id'] = self.env['ir.model'].search([('model', '=', res.pop('model'))]).id
+            res['model_id'] = self.env['ir.model']._get(res.pop('model')).id
         return res
 
     name = fields.Char('Name')
@@ -201,9 +201,9 @@ class MailTemplate(models.Model):
     def onchange_sub_model_object_value_field(self):
         if self.model_object_field:
             if self.model_object_field.ttype in ['many2one', 'one2many', 'many2many']:
-                models = self.env['ir.model'].search([('model', '=', self.model_object_field.relation)])
-                if models:
-                    self.sub_object = models.id
+                model = self.env['ir.model']._get(self.model_object_field.relation)
+                if model:
+                    self.sub_object = model.id
                     self.copyvalue = self.build_expression(self.model_object_field.name, self.sub_model_object_field and self.sub_model_object_field.name or False, self.null_value or False)
             else:
                 self.sub_object = False
@@ -285,7 +285,7 @@ class MailTemplate(models.Model):
             html = '<div>%s</div>' % html
             root = lxml.html.fromstring(html)
 
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         (base_scheme, base_netloc, bpath, bparams, bquery, bfragment) = urlparse.urlparse(base_url)
 
         def _process_link(url):
diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py
index ef27ab2d7c2..902f37bbb28 100644
--- a/addons/mail/models/mail_thread.py
+++ b/addons/mail/models/mail_thread.py
@@ -229,7 +229,7 @@ class MailThread(models.AbstractModel):
 
         # automatic logging unless asked not to (mainly for various testing purpose)
         if not self._context.get('mail_create_nolog'):
-            doc_name = self.env['ir.model'].search([('model', '=', self._name)]).read(['name'])[0]['name']
+            doc_name = self.env['ir.model']._get(self._name).name
             thread.message_post(body=_('%s created') % doc_name)
 
         # auto_subscribe: take values and defaults into account
@@ -663,7 +663,7 @@ class MailThread(models.AbstractModel):
             access_link = self._notification_link_helper('view', message_id=message.id)
 
         if message.model:
-            model_name = self.env['ir.model'].sudo().search([('model', '=', self.env[message.model]._name)]).name_get()[0][1]
+            model_name = self.env['ir.model']._get(message.model).display_name
             view_title = '%s %s' % (_('View'), model_name)
         else:
             view_title = _('View')
@@ -745,7 +745,7 @@ class MailThread(models.AbstractModel):
         alias of the document, if it exists. Override this method to implement
         a custom behavior about reply-to for generated emails. """
         model_name = self.env.context.get('thread_model') or self._name
-        alias_domain = self.env['ir.config_parameter'].get_param("mail.catchall.domain")
+        alias_domain = self.env['ir.config_parameter'].sudo().get_param("mail.catchall.domain")
         res = dict.fromkeys(res_ids, False)
 
         # alias domain: check for aliases and catchall
@@ -768,7 +768,7 @@ class MailThread(models.AbstractModel):
             # left ids: use catchall
             left_ids = set(res_ids).difference(set(aliases.keys()))
             if left_ids:
-                catchall_alias = self.env['ir.config_parameter'].get_param("mail.catchall.alias")
+                catchall_alias = self.env['ir.config_parameter'].sudo().get_param("mail.catchall.alias")
                 if catchall_alias:
                     aliases.update(dict((res_id, '%s@%s' % (catchall_alias, alias_domain)) for res_id in left_ids))
             # compute name of reply-to
@@ -787,7 +787,7 @@ class MailThread(models.AbstractModel):
         """ Get specific notification email values to store on the notification
         mail_mail. Void method, inherit it to add custom values. """
         self.ensure_one()
-        database_uuid = self.env['ir.config_parameter'].get_param('database.uuid')
+        database_uuid = self.env['ir.config_parameter'].sudo().get_param('database.uuid')
         return {'headers': repr({
             'X-Odoo-Objects': "%s-%s" % (self._name, self.id),
             'X-Odoo-db-uuid': database_uuid
@@ -1012,7 +1012,7 @@ class MailThread(models.AbstractModel):
             raise TypeError('message must be an email.message.Message at this point')
         MailMessage = self.env['mail.message']
         Alias, dest_aliases = self.env['mail.alias'], self.env['mail.alias']
-        bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
+        bounce_alias = self.env['ir.config_parameter'].sudo().get_param("mail.bounce.alias")
         fallback_model = model
 
         # get email.message.Message variables for future processing
@@ -1133,7 +1133,7 @@ class MailThread(models.AbstractModel):
             dest_aliases = Alias.search([('alias_name', 'in', rcpt_tos_localparts)])
             if dest_aliases:
                 routes = []
-                for alias in dest_aliases:
+                for alias in dest_aliases.sudo():
                     user_id = alias.alias_user_id.id
                     if not user_id:
                         # TDE note: this could cause crashes, because no clue that the user
diff --git a/addons/mail/models/res_partner.py b/addons/mail/models/res_partner.py
index 3bdec9313db..ba927ac16ab 100644
--- a/addons/mail/models/res_partner.py
+++ b/addons/mail/models/res_partner.py
@@ -65,7 +65,7 @@ class Partner(models.Model):
 
         model_name = False
         if message.model:
-            model_name = self.env['ir.model'].sudo().search([('model', '=', self.env[message.model]._name)]).name_get()[0][1]
+            model_name = self.env['ir.model']._get(message.model).display_name
 
         record_name = message.record_name
 
diff --git a/addons/mail/models/update.py b/addons/mail/models/update.py
index 7e2abfcbfd8..4b66b15e915 100644
--- a/addons/mail/models/update.py
+++ b/addons/mail/models/update.py
@@ -113,9 +113,10 @@ class PublisherWarrantyContract(AbstractModel):
                     pass
             if result.get('enterprise_info'):
                 # Update expiration date
-                self.env['ir.config_parameter'].sudo().set_param('database.expiration_date', result['enterprise_info'].get('expiration_date'), ['base.group_user'])
-                self.env['ir.config_parameter'].sudo().set_param('database.expiration_reason', result['enterprise_info'].get('expiration_reason', 'trial'), ['base.group_system'])
-                self.env['ir.config_parameter'].sudo().set_param('database.enterprise_code', result['enterprise_info'].get('enterprise_code'), ['base.group_user'])
+                set_param = self.env['ir.config_parameter'].sudo().set_param
+                set_param('database.expiration_date', result['enterprise_info'].get('expiration_date'))
+                set_param('database.expiration_reason', result['enterprise_info'].get('expiration_reason', 'trial'))
+                set_param('database.enterprise_code', result['enterprise_info'].get('enterprise_code'))
 
         except Exception:
             if cron_mode:
diff --git a/addons/mail/tests/test_mail_followers.py b/addons/mail/tests/test_mail_followers.py
index c51978993bb..7a82f09f381 100644
--- a/addons/mail/tests/test_mail_followers.py
+++ b/addons/mail/tests/test_mail_followers.py
@@ -25,7 +25,7 @@ class TestMailFollowers(TestMail):
             'mail.channel', groups.ids,
             {self.user_employee.partner_id.id: [self.mt_mg_nodef.id]},
             {test_channel.id: [self.mt_al_nodef.id]})
-        mail_channel_model_id = self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1).id
+        mail_channel_model_id = self.env['ir.model']._get('mail.channel').id
         self.assertFalse(specific)
         self.assertEqual(len(generic), 2)
 
@@ -40,7 +40,7 @@ class TestMailFollowers(TestMail):
 
     def test_m2o_command_update_selective(self):
         test_channel = self.env['mail.channel'].create({'name': 'Test'})
-        mail_channel_model_id = self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1).id
+        mail_channel_model_id = self.env['ir.model']._get('mail.channel').id
         groups = self.group_pigs | self.group_public
         self.env['mail.followers'].create({'partner_id': self.user_employee.partner_id.id, 'res_model_id': mail_channel_model_id, 'res_id': self.group_pigs.id})
         generic, specific = self.env['mail.followers']._add_follower_command(
@@ -136,7 +136,7 @@ class TestMailFollowers(TestMail):
         })
         with self.assertRaises(IntegrityError):
             self.env['mail.followers'].create({
-                'res_model_id': self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1).id,
+                'res_model_id': self.env['ir.model']._get('mail.channel').id,
                 'res_id': test_channel.id,
                 'partner_id': self.user_employee.partner_id.id,
                 'channel_id': self.group_pigs.id,
diff --git a/addons/mail/tests/test_mail_gateway.py b/addons/mail/tests/test_mail_gateway.py
index fd2f80ce103..c017a88df67 100644
--- a/addons/mail/tests/test_mail_gateway.py
+++ b/addons/mail/tests/test_mail_gateway.py
@@ -291,7 +291,7 @@ class TestMailgateway(TestMail):
     def setUp(self):
         super(TestMailgateway, self).setUp()
         # groups@.. will cause the creation of new mail.channels
-        self.mail_channel_model = self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1)
+        self.mail_channel_model = self.env['ir.model']._get('mail.channel')
         self.alias = self.env['mail.alias'].create({
             'alias_name': 'groups',
             'alias_user_id': False,
@@ -299,7 +299,7 @@ class TestMailgateway(TestMail):
             'alias_contact': 'everyone'})
 
         # test@.. will cause the creation of new mail.test
-        self.mail_test_model = self.env['ir.model'].search([('model', '=', 'mail.test')], limit=1)
+        self.mail_test_model = self.env['ir.model']._get('mail.test')
         self.alias_2 = self.env['mail.alias'].create({
             'alias_name': 'test',
             'alias_user_id': False,
diff --git a/addons/mail/tests/test_mail_template.py b/addons/mail/tests/test_mail_template.py
index da335d741a4..26a0336b0fe 100644
--- a/addons/mail/tests/test_mail_template.py
+++ b/addons/mail/tests/test_mail_template.py
@@ -32,7 +32,7 @@ class TestMailTemplate(TestMail):
         self.email_2 = 'test2@example.com'
         self.email_3 = self.partner_1.email
         self.email_template = self.env['mail.template'].create({
-            'model_id': self.env['ir.model'].search([('model', '=', 'mail.channel')], limit=1).id,
+            'model_id': self.env['ir.model']._get('mail.channel').id,
             'name': 'Pigs Template',
             'subject': '${object.name}',
             'body_html': '${object.description}',
diff --git a/addons/mail/wizard/invite.py b/addons/mail/wizard/invite.py
index 1d345af517a..acb89641f75 100644
--- a/addons/mail/wizard/invite.py
+++ b/addons/mail/wizard/invite.py
@@ -18,7 +18,7 @@ class Invite(models.TransientModel):
         if self._context.get('mail_invite_follower_channel_only'):
             result['send_mail'] = False
         if 'message' in fields and model and res_id:
-            model_name = self.env['ir.model'].search([('model', '=', model)]).name_get()[0][1]
+            model_name = self.env['ir.model']._get(model).display_name
             document_name = self.env[model].browse(res_id).name_get()[0][1]
             message = _('<div><p>Hello,</p><p>%s invited you to follow %s document: %s.</p></div>') % (user_name, model_name, document_name)
             result['message'] = message
@@ -46,8 +46,7 @@ class Invite(models.TransientModel):
             new_channels = wizard.channel_ids - document.message_channel_ids
             document.message_subscribe(new_partners.ids, new_channels.ids)
 
-            model_ids = self.env['ir.model'].search([('model', '=', wizard.res_model)])
-            model_name = model_ids.name_get()[0][1]
+            model_name = self.env['ir.model']._get(wizard.res_model).display_name
             # send an email if option checked and if a message exists (do not send void emails)
             if wizard.send_mail and wizard.message and not wizard.message == '<br>':  # when deleting the message, cleditor keeps a <br>
                 message = self.env['mail.message'].create({
diff --git a/addons/mail/wizard/mail_compose_message.py b/addons/mail/wizard/mail_compose_message.py
index bc27da14e7c..35114a2542b 100644
--- a/addons/mail/wizard/mail_compose_message.py
+++ b/addons/mail/wizard/mail_compose_message.py
@@ -392,16 +392,14 @@ class MailComposer(models.TransientModel):
         """ hit save as template button: current form value will be a new
             template attached to the current document. """
         for record in self:
-            models = self.env['ir.model'].search([('model', '=', record.model or 'mail.message')])
-            model_name = ''
-            if models:
-                model_name = models.name
+            model = self.env['ir.model']._get(record.model or 'mail.message')
+            model_name = model.name or ''
             template_name = "%s: %s" % (model_name, tools.ustr(record.subject))
             values = {
                 'name': template_name,
                 'subject': record.subject or False,
                 'body_html': record.body or False,
-                'model_id': models.id or False,
+                'model_id': model.id or False,
                 'attachment_ids': [(6, 0, [att.id for att in record.attachment_ids])],
             }
             template = self.env['mail.template'].create(values)
diff --git a/addons/marketing_campaign/models/ir_actions.py b/addons/marketing_campaign/models/ir_actions.py
index cb9a55db6cc..8eaaa0ce69c 100644
--- a/addons/marketing_campaign/models/ir_actions.py
+++ b/addons/marketing_campaign/models/ir_actions.py
@@ -11,6 +11,6 @@ class IrActionsReportXml(models.Model):
     def search(self, args, offset=0, limit=None, order=None, count=False):
         model_id = self.env.context.get('object_id')
         if model_id:
-            model = self.env['ir.model'].browse(model_id).model
+            model = self.env['ir.model'].browse(model_id).sudo().model
             args.append(('model', '=', model))
         return super(IrActionsReportXml, self).search(args, offset=offset, limit=limit, order=order, count=count)
diff --git a/addons/marketing_campaign/models/marketing_campaign.py b/addons/marketing_campaign/models/marketing_campaign.py
index 2aa745dfaa1..fc841868673 100644
--- a/addons/marketing_campaign/models/marketing_campaign.py
+++ b/addons/marketing_campaign/models/marketing_campaign.py
@@ -291,7 +291,7 @@ class MarketingCampaignActivity(models.Model):
 
     name = fields.Char('Name', required=True)
     campaign_id = fields.Many2one('marketing.campaign', 'Campaign', required=True, ondelete='cascade', index=True)
-    object_id = fields.Many2one(related='campaign_id.object_id', relation='ir.model', string='Object', readonly=True)
+    object_id = fields.Many2one('ir.model', related='campaign_id.object_id', string='Object', readonly=True)
     start = fields.Boolean('Start', help="This activity is launched when the campaign starts.", index=True)
     condition = fields.Text('Condition', required=True, default="True",
         help="Python expression to decide whether the activity can be executed, otherwise it will be deleted or cancelled."
diff --git a/addons/mass_mailing/models/mail_mail.py b/addons/mass_mailing/models/mail_mail.py
index e76c114c3c8..8dae482529f 100644
--- a/addons/mass_mailing/models/mail_mail.py
+++ b/addons/mass_mailing/models/mail_mail.py
@@ -29,7 +29,7 @@ class MailMail(models.Model):
         return mail
 
     def _get_tracking_url(self, partner=None):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         track_url = urlparse.urljoin(
             base_url, 'mail/track/%(mail_id)s/blank.gif?%(params)s' % {
                 'mail_id': self.id,
@@ -39,7 +39,7 @@ class MailMail(models.Model):
         return '<img src="%s" alt=""/>' % track_url
 
     def _get_unsubscribe_url(self, email_to):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         url = urlparse.urljoin(
             base_url, 'mail/mailing/%(mailing_id)s/unsubscribe?%(params)s' % {
                 'mailing_id': self.mailing_id.id,
@@ -75,7 +75,7 @@ class MailMail(models.Model):
                     body = body.replace(href, new_href)
 
         # prepend <base> tag for images using absolute urls
-        domain = self.env["ir.config_parameter"].get_param("web.base.url")
+        domain = self.env["ir.config_parameter"].sudo().get_param("web.base.url")
         base = "<base href='%s'>" % domain
         body = tools.append_content_to_html(base, body, plaintext=False, container_tag='div')
         # resolve relative image url to absolute for outlook.com
@@ -95,7 +95,7 @@ class MailMail(models.Model):
     def send_get_email_dict(self, partner=None):
         # TDE: temporary addition (mail was parameter) due to semi-new-API
         res = super(MailMail, self).send_get_email_dict(partner)
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         if self.mailing_id and res.get('body') and res.get('email_to'):
             emails = tools.email_split(res.get('email_to')[0])
             email_to = emails and emails[0] or False
diff --git a/addons/mass_mailing/models/mail_thread.py b/addons/mass_mailing/models/mail_thread.py
index 066dd285c79..8e515a664f8 100644
--- a/addons/mass_mailing/models/mail_thread.py
+++ b/addons/mass_mailing/models/mail_thread.py
@@ -17,7 +17,7 @@ class MailThread(models.AbstractModel):
     @api.model
     def message_route(self, message, message_dict, model=None, thread_id=None, custom_values=None):
         """ Override to udpate mass mailing statistics based on bounce emails """
-        bounce_alias = self.env['ir.config_parameter'].get_param("mail.bounce.alias")
+        bounce_alias = self.env['ir.config_parameter'].sudo().get_param("mail.bounce.alias")
         email_to = decode_message_header(message, 'To')
         email_to_localpart = (tools.email_split(email_to) or [''])[0].split('@', 1)[0].lower()
 
diff --git a/addons/payment_adyen/models/payment.py b/addons/payment_adyen/models/payment.py
index 75faabeaba4..b54adc58a9c 100644
--- a/addons/payment_adyen/models/payment.py
+++ b/addons/payment_adyen/models/payment.py
@@ -109,7 +109,7 @@ class AcquirerAdyen(models.Model):
 
     @api.multi
     def adyen_form_generate_values(self, values):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         # tmp
         import datetime
         from dateutil import relativedelta
diff --git a/addons/payment_authorize/controllers/main.py b/addons/payment_authorize/controllers/main.py
index 5fc8ba87a69..d88a74554b9 100644
--- a/addons/payment_authorize/controllers/main.py
+++ b/addons/payment_authorize/controllers/main.py
@@ -24,7 +24,7 @@ class AuthorizeController(http.Controller):
         if post:
             request.env['payment.transaction'].sudo().form_feedback(post, 'authorize')
             return_url = post.pop('return_url', '/')
-        base_url = request.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = request.env['ir.config_parameter'].sudo().get_param('web.base.url')
         # Authorize.Net is expecting a response to the POST sent by their server.
         # This response is in the form of a URL that Authorize.Net will pass on to the
         # client's browser to redirect them to the desired location need javascript.
diff --git a/addons/payment_buckaroo/models/payment.py b/addons/payment_buckaroo/models/payment.py
index ed633aa92ad..05e0c314921 100644
--- a/addons/payment_buckaroo/models/payment.py
+++ b/addons/payment_buckaroo/models/payment.py
@@ -85,7 +85,7 @@ class AcquirerBuckaroo(models.Model):
 
     @api.multi
     def buckaroo_form_generate_values(self, values):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         buckaroo_tx_values = dict(values)
         buckaroo_tx_values.update({
             'Brq_websitekey': self.brq_websitekey,
diff --git a/addons/payment_ogone/models/payment.py b/addons/payment_ogone/models/payment.py
index 030c2173b8a..2315091f10a 100644
--- a/addons/payment_ogone/models/payment.py
+++ b/addons/payment_ogone/models/payment.py
@@ -150,7 +150,7 @@ class PaymentAcquirerOgone(models.Model):
         return shasign
 
     def ogone_form_generate_values(self, values):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         ogone_tx_values = dict(values)
         temp_ogone_tx_values = {
             'PSPID': self.ogone_pspid,
diff --git a/addons/payment_payumoney/models/payment.py b/addons/payment_payumoney/models/payment.py
index 0a1d3d6b943..8f44b1233cb 100644
--- a/addons/payment_payumoney/models/payment.py
+++ b/addons/payment_payumoney/models/payment.py
@@ -54,7 +54,7 @@ class PaymentAcquirerPayumoney(models.Model):
     @api.multi
     def payumoney_form_generate_values(self, values):
         self.ensure_one()
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         payumoney_values = dict(values,
                                 key=self.payumoney_merchant_key,
                                 txnid=values['reference'],
diff --git a/addons/point_of_sale/models/pos_session.py b/addons/point_of_sale/models/pos_session.py
index ee00e112ba6..a21712347b8 100644
--- a/addons/point_of_sale/models/pos_session.py
+++ b/addons/point_of_sale/models/pos_session.py
@@ -249,7 +249,7 @@ class PosSession(models.Model):
             for st in session.statement_ids:
                 if abs(st.difference) > st.journal_id.amount_authorized_diff:
                     # The pos manager can close statements with maximums.
-                    if not self.env['ir.model.access'].check_groups("point_of_sale.group_pos_manager"):
+                    if not self.user_has_groups("point_of_sale.group_pos_manager"):
                         raise UserError(_("Your ending balance is too different from the theoretical cash closing (%.2f), the maximum allowed is: %.2f. You can contact your manager to force it.") % (st.difference, st.journal_id.amount_authorized_diff))
                 if (st.journal_id.type not in ['bank', 'cash']):
                     raise UserError(_("The type of the journal for your payment method should be bank or cash "))
diff --git a/addons/product/models/res_company.py b/addons/product/models/res_company.py
index 05e27d47e59..81bdc631177 100644
--- a/addons/product/models/res_company.py
+++ b/addons/product/models/res_company.py
@@ -17,7 +17,7 @@ class ResCompany(models.Model):
                 'name': new_company.name,
                 'currency_id': new_company.currency_id.id,
             })
-        field = self.env['ir.model.fields'].search([('model', '=', 'res.partner'), ('name', '=', 'property_product_pricelist')])
+        field = self.env['ir.model.fields']._get('res.partner', 'property_product_pricelist')
         self.env['ir.property'].create({
             'name': 'property_product_pricelist',
             'company_id': new_company.id,
diff --git a/addons/project/models/project.py b/addons/project/models/project.py
index f8213fff753..56b0035e025 100644
--- a/addons/project/models/project.py
+++ b/addons/project/models/project.py
@@ -257,9 +257,7 @@ class Project(models.Model):
     def write(self, vals):
         # if alias_model has been changed, update alias_model_id accordingly
         if vals.get('alias_model'):
-            vals['alias_model_id'] = self.env['ir.model'].search([
-                ('model', '=', vals.get('alias_model', 'project.task'))
-            ], limit=1).id
+            vals['alias_model_id'] = self.env['ir.model']._get(vals.get('alias_model', 'project.task')).id
         res = super(Project, self).write(vals)
         if 'active' in vals:
             # archiving/unarchiving a project does it on its tasks, too
diff --git a/addons/report/models/report.py b/addons/report/models/report.py
index cf43c8b1203..785240a2670 100644
--- a/addons/report/models/report.py
+++ b/addons/report/models/report.py
@@ -115,7 +115,7 @@ class Report(models.Model):
             user=user,
             res_company=user.company_id,
             website=website,
-            web_base_url=self.env['ir.config_parameter'].get_param('web.base.url', default='')
+            web_base_url=self.env['ir.config_parameter'].sudo().get_param('web.base.url', default='')
         )
         return view_obj.render_template(template, values)
 
diff --git a/addons/sale/security/ir.model.access.csv b/addons/sale/security/ir.model.access.csv
index 16986f400a2..c32389e02d1 100644
--- a/addons/sale/security/ir.model.access.csv
+++ b/addons/sale/security/ir.model.access.csv
@@ -20,8 +20,6 @@ access_res_partner_sale_manager,res.partner.sale.manager,base.model_res_partner,
 access_product_template_sale_user,product.template sale use,product.model_product_template,sales_team.group_sale_salesman,1,0,0,0

 access_product_product_sale_user,product.product sale use,product.model_product_product,sales_team.group_sale_salesman,1,0,0,0

 access_account_tax_user,account.tax.user,account.model_account_tax,sales_team.group_sale_salesman,1,0,0,0

-access_ir_attachment_sales,ir.attachment.sales,base.model_ir_attachment,sales_team.group_sale_salesman,1,1,1,0

-access_ir_attachment_manager,ir.attachment.manager,base.model_ir_attachment,sales_team.group_sale_manager,1,1,1,1

 access_product_uom_user,product.uom.user,product.model_product_uom,sales_team.group_sale_salesman,1,0,0,0

 access_product_pricelist_sale_user,product.pricelist.sale.user,product.model_product_pricelist,sales_team.group_sale_salesman,1,0,0,0

 access_account_account_salesman,account_account salesman,account.model_account_account,sales_team.group_sale_salesman,1,0,0,0

diff --git a/addons/stock_account/models/account_chart_template.py b/addons/stock_account/models/account_chart_template.py
index fdf75e5978e..81de769e45d 100644
--- a/addons/stock_account/models/account_chart_template.py
+++ b/addons/stock_account/models/account_chart_template.py
@@ -21,7 +21,7 @@ class AccountChartTemplate(models.Model):
         PropertyObj = self.env['ir.property']  # Property Stock Journal
         value = self.env['account.journal'].search([('company_id', '=', company.id), ('code', '=', 'STJ'), ('type', '=', 'general')], limit=1)
         if value:
-            field = self.env['ir.model.fields'].search([('name', '=', 'property_stock_journal'), ('model', '=', 'product.category'), ('relation', '=', 'account.journal')], limit=1)
+            field = self.env['ir.model.fields'].sudo().search([('name', '=', 'property_stock_journal'), ('model', '=', 'product.category'), ('relation', '=', 'account.journal')])
             vals = {
                 'name': 'property_stock_journal',
                 'company_id': company.id,
@@ -45,7 +45,7 @@ class AccountChartTemplate(models.Model):
             account = getattr(self, record)
             value = account and 'account.account,' + str(acc_template_ref[account.id]) or False
             if value:
-                field = self.env['ir.model.fields'].search([('name', '=', record), ('model', '=', 'product.category'), ('relation', '=', 'account.account')], limit=1)
+                field = self.env['ir.model.fields'].sudo().search([('name', '=', record), ('model', '=', 'product.category'), ('relation', '=', 'account.account')])
                 vals = {
                     'name': record,
                     'company_id': company.id,
diff --git a/addons/survey/models/survey.py b/addons/survey/models/survey.py
index 2537491d959..99ce35e02a3 100644
--- a/addons/survey/models/survey.py
+++ b/addons/survey/models/survey.py
@@ -104,7 +104,8 @@ class Survey(models.Model):
 
     def _compute_survey_url(self):
         """ Computes a public URL for the survey """
-        base_url = '/' if self.env.context.get('relative_url') else self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = '/' if self.env.context.get('relative_url') else \
+                   self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for survey in self:
             survey.public_url = urljoin(base_url, "survey/start/%s" % (slug(survey)))
             survey.print_url = urljoin(base_url, "survey/print/%s" % (slug(survey)))
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index b1d5c732a13..930a8233eb5 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -18,6 +18,7 @@ import os
 import re
 import sys
 import time
+import werkzeug
 import werkzeug.utils
 import werkzeug.wrappers
 import zlib
@@ -777,6 +778,17 @@ class Session(http.Controller):
         request.session.check_security()
         return None
 
+    @http.route('/web/session/account', type='json', auth="user")
+    def account(self):
+        ICP = request.env['ir.config_parameter'].sudo()
+        params = {
+            'response_type': 'token',
+            'client_id': ICP.get_param('database.uuid') or '',
+            'state': json.dumps({'d': request.db, 'u': ICP.get_param('web.base.url')}),
+            'scope': 'userinfo',
+        }
+        return 'https://accounts.odoo.com/oauth2/auth?' + werkzeug.url_encode(params)
+
     @http.route('/web/session/destroy', type='json', auth="user")
     def destroy(self):
         request.session.logout()
diff --git a/addons/web/static/src/js/widgets/user_menu.js b/addons/web/static/src/js/widgets/user_menu.js
index 3c65ab3ac49..d1cd0eb842b 100644
--- a/addons/web/static/src/js/widgets/user_menu.js
+++ b/addons/web/static/src/js/widgets/user_menu.js
@@ -58,21 +58,11 @@ var UserMenu = Widget.extend({
         });
     },
     on_menu_account: function() {
+        var self = this;
         this.trigger_up('clear_uncommitted_changes', {
             callback: function() {
-                var P = new Model('ir.config_parameter');
-                P.call('get_param', ['database.uuid']).then(function(dbuuid) {
-                    var state = {
-                        'd': session.db,
-                        'u': window.location.protocol + '//' + window.location.host,
-                    };
-                    var params = {
-                        response_type: 'token',
-                        client_id: dbuuid || '',
-                        state: JSON.stringify(state),
-                        scope: 'userinfo',
-                    };
-                    framework.redirect('https://accounts.odoo.com/oauth2/auth?'+$.param(params));
+                self.rpc('/web/session/account').then(function(url) {
+                    framework.redirect(url);
                 }).fail(function(result, ev){
                     ev.preventDefault();
                     framework.redirect('https://accounts.odoo.com/account');
diff --git a/addons/web_diagram/controllers/main.py b/addons/web_diagram/controllers/main.py
index 22761f6cd22..0cc360f064b 100644
--- a/addons/web_diagram/controllers/main.py
+++ b/addons/web_diagram/controllers/main.py
@@ -76,7 +76,7 @@ class DiagramView(http.Controller):
             for i, fld in enumerate(connector_fields):
                 t['options'][connector_fields_string[i]] = tr[fld]
 
-        fields = http.request.env['ir.model.fields']
+        fields = http.request.env['ir.model.fields'].sudo()
         field = fields.search([('model', '=', model), ('relation', '=', node)])
         node_act = http.request.env[node]
         search_acts = node_act.search([(field.relation_field, '=', id)])
diff --git a/addons/web_tour/models/ir_ui_menu.py b/addons/web_tour/models/ir_ui_menu.py
index 81ca5e201c0..94a90e3a2ff 100644
--- a/addons/web_tour/models/ir_ui_menu.py
+++ b/addons/web_tour/models/ir_ui_menu.py
@@ -18,7 +18,7 @@ class IrUiMenu(models.Model):
         menu_ids = [menu.id for menu in self.browse(menu_root['all_menu_ids']) if menu.load_xmlid]
         xmlids = {
             d.res_id: d.module + "." + d.name
-            for d in self.env['ir.model.data'].search([('res_id', 'in', menu_ids), ('model', '=', 'ir.ui.menu')])
+            for d in self.env['ir.model.data'].sudo().search([('res_id', 'in', menu_ids), ('model', '=', 'ir.ui.menu')])
         }
 
         def _find_subtree(tree, node_id):
diff --git a/addons/website/models/ir_actions.py b/addons/website/models/ir_actions.py
index 7d5c831a9fd..176187ea4e0 100644
--- a/addons/website/models/ir_actions.py
+++ b/addons/website/models/ir_actions.py
@@ -28,7 +28,7 @@ class ServerAction(models.Model):
             action.xml_id = res.get(action.id)
 
     def _compute_website_url(self, website_path, xml_id):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         link = website_path or xml_id or (self.id and '%d' % self.id) or ''
         if base_url and link:
             path = '%s/%s' % ('/website/action', link)
diff --git a/addons/website/models/res_config.py b/addons/website/models/res_config.py
index 2716f80c324..1c7a75646f7 100644
--- a/addons/website/models/res_config.py
+++ b/addons/website/models/res_config.py
@@ -59,8 +59,7 @@ class WebsiteConfigSettings(models.TransientModel):
         return dict(google_maps_api_key=google_maps_api_key)
 
     def set_google_maps_api_key(self):
-        self.env['ir.config_parameter'].set_param(
-            'google_maps_api_key', (self.google_maps_api_key or '').strip(), groups=['base.group_system'])
+        self.env['ir.config_parameter'].set_param('google_maps_api_key', (self.google_maps_api_key or '').strip())
 
     @api.depends('language_ids')
     def _compute_language_count(self):
diff --git a/addons/website_blog/controllers/main.py b/addons/website_blog/controllers/main.py
index f6dbc4d9a39..4f36967ba76 100644
--- a/addons/website_blog/controllers/main.py
+++ b/addons/website_blog/controllers/main.py
@@ -172,7 +172,7 @@ class WebsiteBlog(http.Controller):
     def blog_feed(self, blog, limit='15'):
         v = {}
         v['blog'] = blog
-        v['base_url'] = request.env['ir.config_parameter'].get_param('web.base.url')
+        v['base_url'] = request.env['ir.config_parameter'].sudo().get_param('web.base.url')
         v['posts'] = request.env['blog.post'].search([('blog_id','=', blog.id)], limit=min(int(limit), 50))
         r = request.render("website_blog.blog_feed", v, headers=[('Content-Type', 'application/atom+xml')])
         return r
diff --git a/addons/website_blog/models/website_blog.py b/addons/website_blog/models/website_blog.py
index 4473ede211b..46e90fe4cd7 100644
--- a/addons/website_blog/models/website_blog.py
+++ b/addons/website_blog/models/website_blog.py
@@ -194,7 +194,7 @@ class BlogPost(models.Model):
                     'website_blog.blog_post_template_new_post',
                     subject=post.name,
                     values={'post': post},
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_blog.mt_blog_blog_published'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_blog.mt_blog_blog_published'))
             return True
         return False
 
diff --git a/addons/website_crm_partner_assign/__manifest__.py b/addons/website_crm_partner_assign/__manifest__.py
index 3a682a2d48e..09b802183bc 100644
--- a/addons/website_crm_partner_assign/__manifest__.py
+++ b/addons/website_crm_partner_assign/__manifest__.py
@@ -14,9 +14,9 @@ Publish and Assign Partner
     'depends': ['base_geolocalize', 'crm', 'account', 'portal',
                 'website_partner', 'website_google_map', 'website_portal'],
     'data': [
-        'data/portal_data.xml',
-        'data/crm_partner_assign_data.xml',
         'security/ir.model.access.csv',
+        'security/ir_rule.xml',
+        'data/crm_partner_assign_data.xml',
         'wizard/crm_forward_to_partner_view.xml',
         'views/res_partner_views.xml',
         'views/crm_lead_views.xml',
diff --git a/addons/website_crm_partner_assign/data/portal_data.xml b/addons/website_crm_partner_assign/data/portal_data.xml
deleted file mode 100644
index 63fccf0f735..00000000000
--- a/addons/website_crm_partner_assign/data/portal_data.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<odoo>
-        <!-- Partner and address -->
-        <record id="res_partner_grade_access" model="ir.model.access">
-            <field name="name">odoo.portal.res.partner.grade</field>
-            <field name="model_id" ref="website_crm_partner_assign.model_res_partner_grade"/>
-            <field name="group_id" ref="base.group_portal"/>
-            <field name="perm_read" eval="1"/>
-            <field name="perm_create" eval="0"/>
-            <field name="perm_write" eval="0"/>
-            <field name="perm_unlink" eval="0"/>
-        </record>
-
-        <!-- CRM Lead portal -->
-        <record id="assigned_lead_portal_rule_1" model="ir.rule">
-            <field name="name">odoo.portal.crm.lead</field>
-            <field name="model_id" ref="crm.model_crm_lead"/>
-            <field name="groups" eval="[(6,0,[ref('base.group_portal')])]"/>
-            <field name="domain_force">[('partner_assigned_id','child_of',user.commercial_partner_id.id)]</field>
-        </record>
-        <record id="lead_portal_access" model="ir.model.access">
-            <field name="name">odoo.portal.crm.lead</field>
-            <field name="model_id" ref="crm.model_crm_lead"/>
-            <field name="group_id" ref="base.group_portal"/>
-            <field name="perm_read" eval="1"/>
-            <field name="perm_create" eval="0"/>
-            <field name="perm_write" eval="1"/>
-            <field name="perm_unlink" eval="0"/>
-        </record>
-</odoo>
diff --git a/addons/website_crm_partner_assign/security/ir.model.access.csv b/addons/website_crm_partner_assign/security/ir.model.access.csv
index fd1b860ebc5..57a8da57da3 100644
--- a/addons/website_crm_partner_assign/security/ir.model.access.csv
+++ b/addons/website_crm_partner_assign/security/ir.model.access.csv
@@ -11,6 +11,4 @@ access_res_partner_activation_user,res.partner.activation.user,model_res_partner
 access_partner_activation_manager,res.partner.activation.manager,model_res_partner_activation,base.group_partner_manager,1,1,1,1
 partner_access_crm_lead,crm.lead,crm.model_crm_lead,base.group_portal,1,1,0,0
 access_res_partner_grade_invoicing_payment,res.partner.grade,model_res_partner_grade,account.group_account_invoice,1,0,0,0
-access_res_partner_grade_portal,res.partner.grade,model_res_partner_grade,base.group_portal,1,0,0,0
-crm_lead_portal_access,crm.lead.portal,crm.model_crm_lead,base.group_portal,1,1,0,0
-mail_message_subtype_portal_access,mail.message.subtype.portal,mail.model_mail_message_subtype,base.group_portal,1,1,1,0
\ No newline at end of file
+mail_message_subtype_portal_access,mail.message.subtype.portal,mail.model_mail_message_subtype,base.group_portal,1,1,1,0
diff --git a/addons/website_crm_partner_assign/security/ir_rule.xml b/addons/website_crm_partner_assign/security/ir_rule.xml
new file mode 100644
index 00000000000..2084cc5a8f4
--- /dev/null
+++ b/addons/website_crm_partner_assign/security/ir_rule.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <!-- CRM Lead portal -->
+    <record id="assigned_lead_portal_rule_1" model="ir.rule">
+        <field name="name">odoo.portal.crm.lead</field>
+        <field name="model_id" ref="crm.model_crm_lead"/>
+        <field name="groups" eval="[(6,0,[ref('base.group_portal')])]"/>
+        <field name="domain_force">[('partner_assigned_id','child_of',user.commercial_partner_id.id)]</field>
+    </record>
+</odoo>
diff --git a/addons/website_crm_partner_assign/wizard/crm_forward_to_partner.py b/addons/website_crm_partner_assign/wizard/crm_forward_to_partner.py
index d91dccfa67a..5aa8073192f 100644
--- a/addons/website_crm_partner_assign/wizard/crm_forward_to_partner.py
+++ b/addons/website_crm_partner_assign/wizard/crm_forward_to_partner.py
@@ -107,14 +107,14 @@ class CrmLeadForwardToPartner(models.TransientModel):
         action = type == 'opportunity' and 'action_portal_opportunities' or 'action_portal_leads'
         action_ref = self.env.ref('website_crm_partner_assign.%s' % (action,), False)
         portal_link = "%s/?db=%s#id=%s&action=%s&view_type=form" % (
-            self.env['ir.config_parameter'].get_param('web.base.url'),
+            self.env['ir.config_parameter'].sudo().get_param('web.base.url'),
             self.env.cr.dbname,
             lead_id,
             action_ref and action_ref.id or False)
         return portal_link
 
     def get_portal_url(self):
-        portal_link = "%s/?db=%s" % (self.env['ir.config_parameter'].get_param('web.base.url'), self.env.cr.dbname)
+        portal_link = "%s/?db=%s" % (self.env['ir.config_parameter'].sudo().get_param('web.base.url'), self.env.cr.dbname)
         return portal_link
 
     forward_type = fields.Selection([
diff --git a/addons/website_event_track/models/website_event_track.py b/addons/website_event_track/models/website_event_track.py
index 58154b9bb9a..53e116641f4 100644
--- a/addons/website_event_track/models/website_event_track.py
+++ b/addons/website_event_track/models/website_event_track.py
@@ -68,7 +68,7 @@ class Track(models.Model):
         res.message_post_with_view(
             'website_event_track.event_track_template_new',
             subject=res.name,
-            subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_event_track.mt_event_track'))
+            subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_event_track.mt_event_track'))
         return res
 
     @api.multi
diff --git a/addons/website_form/controllers/main.py b/addons/website_form/controllers/main.py
index 742a8eeb0b7..2f5f7ec2292 100644
--- a/addons/website_form/controllers/main.py
+++ b/addons/website_form/controllers/main.py
@@ -21,7 +21,7 @@ class WebsiteForm(http.Controller):
     # Check and insert values from the form on the model <model>
     @http.route('/website_form/<string:model_name>', type='http', auth="public", methods=['POST'], website=True)
     def website_form(self, model_name, **kwargs):
-        model_record = request.env['ir.model'].search([('model', '=', model_name), ('website_form_access', '=', True)])
+        model_record = request.env['ir.model'].sudo().search([('model', '=', model_name), ('website_form_access', '=', True)])
         if not model_record:
             return json.dumps(False)
 
diff --git a/addons/website_form/models/models.py b/addons/website_form/models/models.py
index 16aba290a2a..f1a80abbb68 100644
--- a/addons/website_form/models/models.py
+++ b/addons/website_form/models/models.py
@@ -41,13 +41,14 @@ class website_form_model(models.Model):
             ])
         }
         return {
-            k: v for k, v in self.get_authorized_fields().iteritems()
+            k: v for k, v in self.get_authorized_fields(self.model).iteritems()
             if k not in excluded
         }
 
-    @api.multi
-    def get_authorized_fields(self):
-        model = self.env[self.model]
+    @api.model
+    def get_authorized_fields(self, model_name):
+        """ Return the fields of the given model name as a mapping like method `fields_get`. """
+        model = self.env[model_name]
         fields_get = model.fields_get()
 
         for key, val in model._inherits.iteritems():
diff --git a/addons/website_forum/data/forum_data.xml b/addons/website_forum/data/forum_data.xml
index df39faa0371..b4a2a56ceba 100644
--- a/addons/website_forum/data/forum_data.xml
+++ b/addons/website_forum/data/forum_data.xml
@@ -13,7 +13,7 @@
         </record>
     </data>
     <data>
-        <function model="ir.config_parameter" name="set_param" eval="('auth_signup.allow_uninvited', True)" />
+        <function model="ir.config_parameter" name="set_param" eval="('auth_signup.allow_uninvited', True)"/>
 
         <!-- JUMP TO FORUM AT INSTALL -->
         <record id="action_open_forum" model="ir.actions.act_url">
diff --git a/addons/website_forum/models/forum.py b/addons/website_forum/models/forum.py
index c286bfcdfb8..84f9ed7c117 100644
--- a/addons/website_forum/models/forum.py
+++ b/addons/website_forum/models/forum.py
@@ -33,7 +33,7 @@ class Forum(models.Model):
         TDE TODO: move me somewhere else, auto_init ? """
         forum_uuids = self.env['ir.config_parameter'].search([('key', '=', 'website_forum.uuid')])
         if not forum_uuids:
-            forum_uuids.set_param('website_forum.uuid', str(uuid.uuid4()), ['base.group_system'])
+            forum_uuids.set_param('website_forum.uuid', str(uuid.uuid4()))
 
     @api.model
     def _get_default_faq(self):
@@ -525,14 +525,14 @@ class Post(models.Model):
                     subject=_('Re: %s') % post.parent_id.name,
                     partner_ids=[(4, p.id) for p in tag_partners],
                     channel_ids=[(4, c.id) for c in tag_channels],
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_forum.mt_answer_new'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_forum.mt_answer_new'))
             elif post.state == 'active' and not post.parent_id:
                 post.message_post_with_view(
                     'website_forum.forum_post_template_new_question',
                     subject=post.name,
                     partner_ids=[(4, p.id) for p in tag_partners],
                     channel_ids=[(4, c.id) for c in tag_channels],
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('website_forum.mt_question_new'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('website_forum.mt_question_new'))
             elif post.state == 'pending' and not post.parent_id:
                 # TDE FIXME: in master, you should probably use a subtype;
                 # however here we remove subtype but set partner_ids
@@ -543,7 +543,7 @@ class Post(models.Model):
                     'website_forum.forum_post_template_validation',
                     subject=post.name,
                     partner_ids=partners.ids,
-                    subtype_id=self.env['ir.model.data'].sudo().xmlid_to_res_id('mail.mt_note'))
+                    subtype_id=self.env['ir.model.data'].xmlid_to_res_id('mail.mt_note'))
         return True
 
     @api.multi
diff --git a/addons/website_forum/models/res_users.py b/addons/website_forum/models/res_users.py
index e07ca40d51d..499fccaba8f 100644
--- a/addons/website_forum/models/res_users.py
+++ b/addons/website_forum/models/res_users.py
@@ -84,7 +84,7 @@ class Users(models.Model):
                 'email': self.email}
             if forum_id:
                 params['forum_id'] = forum_id
-            base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+            base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
             token_url = base_url + '/forum/validate_email?%s' % urlencode(params)
             activation_template.sudo().with_context(token_url=token_url).send_mail(self.id, force_send=True)
         return True
diff --git a/addons/website_hr_recruitment/models/hr_recruitment.py b/addons/website_hr_recruitment/models/hr_recruitment.py
index 1a0960a444e..662bf0b4f48 100644
--- a/addons/website_hr_recruitment/models/hr_recruitment.py
+++ b/addons/website_hr_recruitment/models/hr_recruitment.py
@@ -17,7 +17,7 @@ class RecruitmentSource(models.Model):
     @api.one
     @api.depends('source_id', 'source_id.name', 'job_id')
     def _compute_url(self):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for source in self:
             source.url = urljoin(base_url, "%s?%s" % (source.job_id.website_url,
                 url_encode({
diff --git a/addons/website_mail_channel/models/mail_channel.py b/addons/website_mail_channel/models/mail_channel.py
index 5cc8163c81c..924d4ea25ea 100644
--- a/addons/website_mail_channel/models/mail_channel.py
+++ b/addons/website_mail_channel/models/mail_channel.py
@@ -17,7 +17,7 @@ class MailGroup(models.Model):
     def message_get_email_values(self, notif_mail=None):
         self.ensure_one()
         res = super(MailGroup, self).message_get_email_values(notif_mail=notif_mail)
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         headers = {}
         if res.get('headers'):
             try:
diff --git a/addons/website_mail_channel/models/mail_mail.py b/addons/website_mail_channel/models/mail_mail.py
index e9ff236540c..4257c828b66 100644
--- a/addons/website_mail_channel/models/mail_mail.py
+++ b/addons/website_mail_channel/models/mail_mail.py
@@ -15,7 +15,7 @@ class MailMail(models.Model):
         if self.model == 'mail.channel' and self.res_id:
             # no super() call on purpose, no private links that could be quoted!
             channel = self.env['mail.channel'].browse(self.res_id)
-            base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+            base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
             vals = {
                 'maillist': _('Mailing-List'),
                 'post_to': _('Post to'),
diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py
index d8bff5d798b..3ec5d7f591e 100644
--- a/addons/website_sale/controllers/main.py
+++ b/addons/website_sale/controllers/main.py
@@ -507,7 +507,7 @@ class WebsiteSale(http.Controller):
 
     def values_postprocess(self, order, mode, values, errors, error_msg):
         new_values = {}
-        authorized_fields = request.env['ir.model'].sudo().search([('model', '=', 'res.partner')])._get_form_writable_fields()
+        authorized_fields = request.env['ir.model']._get('res.partner')._get_form_writable_fields()
         for k, v in values.items():
             # don't drop empty value, it could be a field to reset
             if k in authorized_fields and v is not None:
diff --git a/addons/website_slides/controllers/main.py b/addons/website_slides/controllers/main.py
index ed9b374c70c..4b2cee0b411 100644
--- a/addons/website_slides/controllers/main.py
+++ b/addons/website_slides/controllers/main.py
@@ -333,7 +333,7 @@ class WebsiteSlides(http.Controller):
 
         # determine if it is embedded from external web page
         referrer_url = request.httprequest.headers.get('Referer', '')
-        base_url = request.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = request.env['ir.config_parameter'].sudo().get_param('web.base.url')
         is_embedded = referrer_url and not bool(base_url in referrer_url) or False
         # try accessing slide, and display to corresponding template
         try:
diff --git a/addons/website_slides/data/website_slides_data.xml b/addons/website_slides/data/website_slides_data.xml
index 31e8ebf2f9f..c559e07d10d 100644
--- a/addons/website_slides/data/website_slides_data.xml
+++ b/addons/website_slides/data/website_slides_data.xml
@@ -5,7 +5,6 @@
         <record model="ir.config_parameter" id="google_app_key">
             <field name="key">website_slides.google_app_key</field>
             <field name="value">AIzaSyDOWlmDW-7DbLmOR9ZsT5AOEXf4n6TFwQA</field>
-            <field name="group_ids" eval="[(4, ref('base.group_system'))]" />
         </record>
 
         <record id="website_menu_slides" model="website.menu">
diff --git a/addons/website_slides/models/slides.py b/addons/website_slides/models/slides.py
index e31f9c01415..247094d605f 100644
--- a/addons/website_slides/models/slides.py
+++ b/addons/website_slides/models/slides.py
@@ -146,7 +146,7 @@ class Channel(models.Model):
     @api.depends('name')
     def _compute_website_url(self):
         super(Channel, self)._compute_website_url()
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for channel in self:
             if channel.id:  # avoid to perform a slug on a not yet saved record in case of an onchange.
                 channel.website_url = '%s/slides/%s' % (base_url, slug(channel))
@@ -347,7 +347,7 @@ class Slide(models.Model):
     embed_code = fields.Text('Embed Code', readonly=True, compute='_get_embed_code')
 
     def _get_embed_code(self):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for record in self:
             if record.datas and (not record.document_id or record.slide_type in ['document', 'presentation']):
                 record.embed_code = '<iframe src="%s/slides/embed/%s?page=1" allowFullScreen="true" height="%s" width="%s" frameborder="0"></iframe>' % (base_url, record.id, 315, 420)
@@ -365,7 +365,7 @@ class Slide(models.Model):
     @api.depends('name')
     def _compute_website_url(self):
         super(Slide, self)._compute_website_url()
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for slide in self:
             if slide.id:  # avoid to perform a slug on a not yet saved record in case of an onchange.
                 # link_tracker is not in dependencies, so use it to shorten url only if installed.
@@ -473,7 +473,7 @@ class Slide(models.Model):
             yield record
 
     def _post_publication(self):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         for slide in self.filtered(lambda slide: slide.website_published and slide.channel_id.publish_template_id):
             publish_template = slide.channel_id.publish_template_id
             html_body = publish_template.with_context({'base_url': base_url}).render_template(publish_template.body_html, 'slide.slide', slide.id)
@@ -486,7 +486,7 @@ class Slide(models.Model):
 
     @api.one
     def send_share_email(self, email):
-        base_url = self.env['ir.config_parameter'].get_param('web.base.url')
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
         return self.channel_id.share_template_id.with_context({'email': email, 'base_url': base_url}).send_mail(self.id)
 
     # --------------------------------------------------