[FIX] base: verify the rights on individual records too

The access rights of a model was checked but not the records themself.
In case a user has access to a model but not to a specific record, he
should not be able to execute a server action on it.

Correct the ir.rule on private partners to be also verified for other
operations than read.
While it was not possible to actually write on it (due to side effects
of ORM where write implies a read operation),
check_access_rule('write') was working on a private address

closes odoo/odoo#59740

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

3 files changed, 43 insertions, 7 deletions

diff --git a/odoo/addons/base/models/ir_actions.py b/odoo/addons/base/models/ir_actions.py
index eb6e8a8d19d..2cbd196debf 100644
--- a/odoo/addons/base/models/ir_actions.py
+++ b/odoo/addons/base/models/ir_actions.py
@@ -604,6 +604,16 @@ class IrActionsServer(models.Model):
                     raise
 
             eval_context = self._get_eval_context(action)
+            records = eval_context.get('record') or eval_context['model']
+            records |= eval_context.get('records') or eval_context['model']
+            if records:
+                try:
+                    records.check_access_rule('write')
+                except AccessError:
+                    _logger.warning("Forbidden server action %r executed while the user %s does not have access to %s.",
+                        action.name, self.env.user.login, records,
+                    )
+                    raise
 
             runner, multi = action._get_runner()
             if runner and multi:
diff --git a/odoo/addons/base/security/base_security.xml b/odoo/addons/base/security/base_security.xml
index b70806b4d4f..3f36e7b17ee 100644
--- a/odoo/addons/base/security/base_security.xml
+++ b/odoo/addons/base/security/base_security.xml
@@ -85,9 +85,9 @@
                 (4, ref('base.group_user')),
             ]"/>
             <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="False"/>
-            <field name="perm_create" eval="False"/>
-            <field name="perm_unlink" eval="False"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="True"/>
         </record>
         <!-- Relex previous rule for group_private_addresses -->
         <record id="res_partner_rule_private_group" model="ir.rule">
@@ -100,9 +100,9 @@
                 (4, ref('base.group_private_addresses'))
             ]"/>
             <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="False"/>
-            <field name="perm_create" eval="False"/>
-            <field name="perm_unlink" eval="False"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="True"/>
         </record>
 
         <!-- Restrict modifications on ir.filters to owner only -->
diff --git a/odoo/addons/base/tests/test_ir_actions.py b/odoo/addons/base/tests/test_ir_actions.py
index 1f4a51bbe5a..629c721aefc 100644
--- a/odoo/addons/base/tests/test_ir_actions.py
+++ b/odoo/addons/base/tests/test_ir_actions.py
@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+from datetime import date
 from psycopg2 import IntegrityError, ProgrammingError
 
 import odoo
@@ -50,6 +51,7 @@ class TestServerActionsBase(common.TransactionCase):
         self.action = self.env['ir.actions.server'].create({
             'name': 'TestAction',
             'model_id': self.res_partner_model.id,
+            'model_name': 'res.partner',
             'state': 'code',
             'code': 'record.write({"comment": "MyComment"})',
         })
@@ -268,7 +270,7 @@ class TestServerActions(TestServerActionsBase):
         self.assertEqual([vals.get('name') for vals in bindings['action']], ['TestAction2', 'TestAction'])
         self.assertEqual([vals.get('sequence') for vals in bindings['action']], [1, 5])
 
-    def test_copy_action(self):
+    def test_70_copy_action(self):
         # first check that the base case (reset state) works normally
         r = self.env['ir.actions.todo'].create({
             'action_id': self.action.id,
@@ -286,6 +288,30 @@ class TestServerActions(TestServerActionsBase):
             "copying a server action should not reset the state"
         )
 
+    def test_80_permission(self):
+        self.action.write({
+            'state': 'code',
+            'code': """record.write({'date': datetime.date.today()})""",
+        })
+
+        user_demo = self.env.ref("base.user_demo")
+        self_demo = self.action.with_user(user_demo.id)
+
+        # can write on contact partner
+        self.test_partner.type = "contact"
+        self.test_partner.with_user(user_demo.id).check_access_rule("write")
+
+        self_demo.with_context(self.context).run()
+        self.assertEqual(self.test_partner.date, date.today())
+
+        # but can not write on private address
+        self.test_partner.type = "private"
+        with self.assertRaises(AccessError):
+            self.test_partner.with_user(user_demo.id).check_access_rule("write")
+        # nor execute a server action on it
+        with self.assertRaises(AccessError), mute_logger('odoo.addons.base.models.ir_actions'):
+            self_demo.with_context(self.context).run()
+
 
 class TestCustomFields(common.TransactionCase):
     MODEL = 'res.partner'