[FIX] account: improve security in reports and in account's query_get()

* privatize the get_report_values() method
* check read access rights and ir.rules in _query_get() from account module

Was task 36590
Was PR #25822

24 files changed, 29 insertions, 23 deletions

diff --git a/addons/account/models/account_move.py b/addons/account/models/account_move.py
index 91bdaedbd3a..343a08ac9e0 100644
--- a/addons/account/models/account_move.py
+++ b/addons/account/models/account_move.py
@@ -1271,6 +1271,8 @@ class AccountMoveLine(models.Model):
 
     @api.model
     def _query_get(self, domain=None):
+        self.check_access_rights('read')
+
         context = dict(self._context or {})
         domain = domain or []
         if not isinstance(domain, (list, tuple)):
@@ -1328,6 +1330,10 @@ class AccountMoveLine(models.Model):
         tables = ''
         if domain:
             query = self._where_calc(domain)
+
+            # Wrap the query with 'company_id IN (...)' to avoid bypassing company access rights.
+            self._apply_ir_rules(query)
+
             tables, where_clause, where_clause_params = query.get_sql()
         return tables, where_clause, where_clause_params
 
diff --git a/addons/account/report/account_aged_partner_balance.py b/addons/account/report/account_aged_partner_balance.py
index 7b9c5c33f93..35a423b1550 100644
--- a/addons/account/report/account_aged_partner_balance.py
+++ b/addons/account/report/account_aged_partner_balance.py
@@ -211,7 +211,7 @@ class ReportAgedPartnerBalance(models.AbstractModel):
         return res, total, lines
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/account/report/account_balance.py b/addons/account/report/account_balance.py
index 3c54e886d13..020a71efea6 100644
--- a/addons/account/report/account_balance.py
+++ b/addons/account/report/account_balance.py
@@ -59,7 +59,7 @@ class ReportTrialBalance(models.AbstractModel):
 
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/account/report/account_general_ledger.py b/addons/account/report/account_general_ledger.py
index be46e7b361b..ce7ce9f113f 100644
--- a/addons/account/report/account_general_ledger.py
+++ b/addons/account/report/account_general_ledger.py
@@ -109,7 +109,7 @@ class ReportGeneralLedger(models.AbstractModel):
         return account_res
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/account/report/account_invoice_report.py b/addons/account/report/account_invoice_report.py
index 0ec63187a9a..16f7f5360ee 100644
--- a/addons/account/report/account_invoice_report.py
+++ b/addons/account/report/account_invoice_report.py
@@ -179,7 +179,7 @@ class ReportInvoiceWithPayment(models.AbstractModel):
     _name = 'report.account.report_invoice_with_payments'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         report = self.env['ir.actions.report']._get_report_from_name('account.report_invoice_with_payments')
         return {
             'doc_ids': docids,
diff --git a/addons/account/report/account_journal.py b/addons/account/report/account_journal.py
index 083dae336a7..8521ecffc05 100644
--- a/addons/account/report/account_journal.py
+++ b/addons/account/report/account_journal.py
@@ -95,7 +95,7 @@ class ReportJournal(models.AbstractModel):
         return self.env['account.move.line'].with_context(data['form'].get('used_context', {}))._query_get()
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/account/report/account_overdue_report.py b/addons/account/report/account_overdue_report.py
index 99463c482bb..12e25678b3e 100644
--- a/addons/account/report/account_overdue_report.py
+++ b/addons/account/report/account_overdue_report.py
@@ -31,7 +31,7 @@ class ReportOverdue(models.AbstractModel):
         return res
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         totals = {}
         lines = self._get_account_move_lines(docids)
         lines_to_display = {}
diff --git a/addons/account/report/account_partner_ledger.py b/addons/account/report/account_partner_ledger.py
index 68fe77f8f40..ccd2c41d647 100644
--- a/addons/account/report/account_partner_ledger.py
+++ b/addons/account/report/account_partner_ledger.py
@@ -69,7 +69,7 @@ class ReportPartnerLedger(models.AbstractModel):
         return result
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/account/report/account_report_financial.py b/addons/account/report/account_report_financial.py
index e68e5d6d9fb..5f0f5bd497c 100644
--- a/addons/account/report/account_report_financial.py
+++ b/addons/account/report/account_report_financial.py
@@ -144,7 +144,7 @@ class ReportFinancial(models.AbstractModel):
         return lines
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/account/report/account_tax.py b/addons/account/report/account_tax.py
index 97cdff1484a..e41ee0564f0 100644
--- a/addons/account/report/account_tax.py
+++ b/addons/account/report/account_tax.py
@@ -8,7 +8,7 @@ class ReportTax(models.AbstractModel):
     _name = 'report.account.report_tax'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
         return {
diff --git a/addons/account_test/report/report_account_test.py b/addons/account_test/report/report_account_test.py
index ac64c1faea0..1420f647cf8 100644
--- a/addons/account_test/report/report_account_test.py
+++ b/addons/account_test/report/report_account_test.py
@@ -61,7 +61,7 @@ class ReportAssertAccount(models.AbstractModel):
         return result
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         report = self.env['ir.actions.report']._get_report_from_name('account_test.report_accounttest')
         records = self.env['accounting.assert.test'].browse(self.ids)
         return {
diff --git a/addons/hr_holidays/report/holidays_summary_report.py b/addons/hr_holidays/report/holidays_summary_report.py
index 1532f49e0f3..1f75ea51fae 100644
--- a/addons/hr_holidays/report/holidays_summary_report.py
+++ b/addons/hr_holidays/report/holidays_summary_report.py
@@ -107,7 +107,7 @@ class HrHolidaySummaryReport(models.AbstractModel):
         return res
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/hr_payroll/report/report_contribution_register.py b/addons/hr_payroll/report/report_contribution_register.py
index 16de7b5e948..f9e44981d00 100644
--- a/addons/hr_payroll/report/report_contribution_register.py
+++ b/addons/hr_payroll/report/report_contribution_register.py
@@ -29,7 +29,7 @@ class ContributionRegisterReport(models.AbstractModel):
         return result
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/hr_payroll/report/report_payslip_details.py b/addons/hr_payroll/report/report_payslip_details.py
index ffd5b9d913d..3c44ca838a1 100644
--- a/addons/hr_payroll/report/report_payslip_details.py
+++ b/addons/hr_payroll/report/report_payslip_details.py
@@ -86,7 +86,7 @@ class PayslipDetailsReport(models.AbstractModel):
         return res
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         payslips = self.env['hr.payslip'].browse(docids)
         return {
             'doc_ids': docids,
diff --git a/addons/l10n_fr_hr_payroll/report/fiche_paye.py b/addons/l10n_fr_hr_payroll/report/fiche_paye.py
index a4e24cb43ea..95874f8ee4b 100644
--- a/addons/l10n_fr_hr_payroll/report/fiche_paye.py
+++ b/addons/l10n_fr_hr_payroll/report/fiche_paye.py
@@ -30,7 +30,7 @@ class FichePayeParser(models.AbstractModel):
         return self.env['hr.payslip.line'].search([('slip_id', '=', obj.id), ('salary_rule_id.parent_rule_id.id', '=', parent_line.salary_rule_id.id)], limit=1)
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         payslip = self.env['hr.payslip'].browse(docids)
         return {
             'doc_ids': docids,
diff --git a/addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py b/addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py
index f81c7f7b996..1b64302203c 100644
--- a/addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py
+++ b/addons/l10n_in_hr_payroll/report/report_hr_salary_employee_bymonth.py
@@ -93,7 +93,7 @@ class ReportHrSalaryEmployeeBymonth(models.AbstractModel):
         return self.total
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not data.get('form') or not self.env.context.get('active_model') or not self.env.context.get('active_id'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py b/addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py
index 0d26efe9bf5..de948a03fee 100644
--- a/addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py
+++ b/addons/l10n_in_hr_payroll/report/report_hr_yearly_salary_detail.py
@@ -126,7 +126,7 @@ class EmployeesYearlySalaryReport(models.AbstractModel):
         return self.total
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         if not self.env.context.get('active_model') or not self.env.context.get('active_id'):
             raise UserError(_("Form content is missing, this report cannot be printed."))
 
diff --git a/addons/l10n_in_hr_payroll/report/report_payroll_advice.py b/addons/l10n_in_hr_payroll/report/report_payroll_advice.py
index e72e95f0683..0a294694404 100644
--- a/addons/l10n_in_hr_payroll/report/report_payroll_advice.py
+++ b/addons/l10n_in_hr_payroll/report/report_payroll_advice.py
@@ -42,7 +42,7 @@ class payroll_advice_report(models.AbstractModel):
         return result
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         advice = self.env['hr.payroll.advice'].browse(docids)
         return {
             'doc_ids': docids,
diff --git a/addons/l10n_in_hr_payroll/report/report_payslip_details.py b/addons/l10n_in_hr_payroll/report/report_payslip_details.py
index 02e4af7b0a2..373ddd89ebb 100644
--- a/addons/l10n_in_hr_payroll/report/report_payslip_details.py
+++ b/addons/l10n_in_hr_payroll/report/report_payslip_details.py
@@ -9,7 +9,7 @@ class PayslipDetailsReportIN(models.AbstractModel):
     _inherit = 'report.hr_payroll.report_payslipdetails'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         payslips = self.env['hr.payslip'].browse(docids)
         return {
             'doc_ids': docids,
diff --git a/addons/mrp/report/mrp_report_bom_structure.py b/addons/mrp/report/mrp_report_bom_structure.py
index c9a461815a1..7af40fcb785 100644
--- a/addons/mrp/report/mrp_report_bom_structure.py
+++ b/addons/mrp/report/mrp_report_bom_structure.py
@@ -9,7 +9,7 @@ class ReportBomStructure(models.AbstractModel):
     _name = 'report.mrp.report_bom_structure'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         docs = []
         for bom_id in docids:
             bom = self.env['mrp.bom'].browse(bom_id)
diff --git a/addons/point_of_sale/models/pos_order.py b/addons/point_of_sale/models/pos_order.py
index 2972e9f7e2c..93a6a4a5e3a 100644
--- a/addons/point_of_sale/models/pos_order.py
+++ b/addons/point_of_sale/models/pos_order.py
@@ -1124,7 +1124,7 @@ class ReportSaleDetails(models.AbstractModel):
         }
 
     @api.multi
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         data = dict(data or {})
         configs = self.env['pos.config'].browse(data['config_ids'])
         data.update(self.get_sale_details(data['date_start'], data['date_stop'], configs))
diff --git a/addons/point_of_sale/report/pos_invoice.py b/addons/point_of_sale/report/pos_invoice.py
index 7e25d2c6a80..6f51e30a3e4 100644
--- a/addons/point_of_sale/report/pos_invoice.py
+++ b/addons/point_of_sale/report/pos_invoice.py
@@ -9,7 +9,7 @@ class PosInvoiceReport(models.AbstractModel):
     _name = 'report.point_of_sale.report_invoice'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         PosOrder = self.env['pos.order']
         ids_to_print = []
         invoiced_posorders_ids = []
diff --git a/addons/product/report/product_pricelist.py b/addons/product/report/product_pricelist.py
index 91f72d6cadd..1b5c56003cf 100644
--- a/addons/product/report/product_pricelist.py
+++ b/addons/product/report/product_pricelist.py
@@ -9,7 +9,7 @@ class report_product_pricelist(models.AbstractModel):
     _name = 'report.product.report_pricelist'
 
     @api.model
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         data = data if data is not None else {}
         pricelist = self.env['product.pricelist'].browse(data.get('form', {}).get('price_list', False))
         products = self.env['product.product'].browse(data.get('ids', data.get('active_ids')))
diff --git a/addons/sale/report/sale_report.py b/addons/sale/report/sale_report.py
index 25ea9aa316c..23bcb4bd13b 100644
--- a/addons/sale/report/sale_report.py
+++ b/addons/sale/report/sale_report.py
@@ -135,7 +135,7 @@ class SaleOrderReportProforma(models.AbstractModel):
     _name = 'report.sale.report_saleproforma'
 
     @api.multi
-    def get_report_values(self, docids, data=None):
+    def _get_report_values(self, docids, data=None):
         docs = self.env['sale.order'].browse(docids)
         return {
             'doc_ids': docs.ids,