[IMP] base: tighten `ir.model.fields` access rights

6 files changed, 14 insertions, 9 deletions

diff --git a/odoo/addons/base/ir/ir_model.py b/odoo/addons/base/ir/ir_model.py
index 8d037a73097..044d3b16f47 100644
--- a/odoo/addons/base/ir/ir_model.py
+++ b/odoo/addons/base/ir/ir_model.py
@@ -399,6 +399,12 @@ class IrModelFields(models.Model):
                     'message': _("The table %r if used for other, possibly incompatible fields.") % self.relation_table,
                 }}
 
+    def _get(self, model_name, name):
+        """ Return the (sudoed) `ir.model.fields` record with the given model and name.
+        The result may be an empty recordset if the model is not found.
+        """
+        return self.sudo().search([('model', '=', model_name), ('name', '=', name)])
+
     @api.multi
     def _drop_column(self):
         tables_to_drop = set()
diff --git a/odoo/addons/base/ir/ir_translation.py b/odoo/addons/base/ir/ir_translation.py
index 46f3dbba1a0..4e29abea7a5 100644
--- a/odoo/addons/base/ir/ir_translation.py
+++ b/odoo/addons/base/ir/ir_translation.py
@@ -501,7 +501,7 @@ class IrTranslation(models.Model):
         :param model_name: the name of a model
         :return: the model's fields' strings as a dictionary `{field_name: field_string}`
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         return {field.name: field.field_description for field in fields}
 
     @api.model
@@ -513,7 +513,7 @@ class IrTranslation(models.Model):
         :param model_name: the name of a model
         :return: the model's fields' help as a dictionary `{field_name: field_help}`
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         return {field.name: field.help for field in fields}
 
     @api.multi
@@ -752,7 +752,7 @@ class IrTranslation(models.Model):
 
         :return: action definition to open the list of available translations
         """
-        fields = self.env['ir.model.fields'].search([('model', '=', model_name)])
+        fields = self.env['ir.model.fields'].sudo().search([('model', '=', model_name)])
         view = self.env.ref("base.view_translation_tree", False) or self.env['ir.ui.view']
         return {
             'name': _("Technical Translations"),
diff --git a/odoo/addons/base/module/report/ir_module_reference_print.py b/odoo/addons/base/module/report/ir_module_reference_print.py
index 19587b3cb8f..813662bf945 100644
--- a/odoo/addons/base/module/report/ir_module_reference_print.py
+++ b/odoo/addons/base/module/report/ir_module_reference_print.py
@@ -20,7 +20,7 @@ class IrModelReferenceReport(models.AbstractModel):
         data = Data.search([('model', '=', 'ir.model.fields'), ('module', '=', module.name), ('name', 'like', fname_wildcard)])
         if data:
             res_ids = data.mapped('res_ids')
-            fnames = self.env['ir.model.fields'].browse(res_ids).mapped('name')
+            fnames = self.env['ir.model.fields'].sudo().browse(res_ids).mapped('name')
             return sorted(self.env[model].fields_get(fnames).iteritems())
         return []
 
diff --git a/odoo/addons/base/res/ir_property.py b/odoo/addons/base/res/ir_property.py
index de3f4d9d214..82db6eba933 100644
--- a/odoo/addons/base/res/ir_property.py
+++ b/odoo/addons/base/res/ir_property.py
@@ -79,7 +79,7 @@ class Property(models.Model):
                 else:
                     field_id = self.env['ir.model.fields'].browse(field_id)
 
-                value = '%s,%d' % (field_id.relation, value)
+                value = '%s,%d' % (field_id.sudo().relation, value)
 
         values[field] = value
         return values
diff --git a/odoo/addons/base/security/ir.model.access.csv b/odoo/addons/base/security/ir.model.access.csv
index 432c566d506..985089057ea 100644
--- a/odoo/addons/base/security/ir.model.access.csv
+++ b/odoo/addons/base/security/ir.model.access.csv
@@ -14,7 +14,6 @@
 "access_ir_model_access_all","ir_model_access_all","model_ir_model_access",,1,0,0,0
 "access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
-"access_ir_model_fields_all","ir_model_fields all","model_ir_model_fields",,1,0,0,0
 "access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1
 "access_ir_module_module_dependency_group_system","ir_module_module_dependency group_system","model_ir_module_module_dependency","group_system",1,1,1,1
diff --git a/odoo/report/custom.py b/odoo/report/custom.py
index e2fc352ad37..ae61614c895 100644
--- a/odoo/report/custom.py
+++ b/odoo/report/custom.py
@@ -134,7 +134,7 @@ class report_custom(report_int):
                 field_child = f['field_child'+str(i)]
                 if field_child:
                     row.append(
-                        env['ir.model.fields'].browse(field_child[0]).name
+                        env['ir.model.fields'].sudo().browse(field_child[0]).name
                     )
                     if f['fc'+str(i)+'_operande']:
                         fct_name = 'id'
@@ -342,7 +342,7 @@ class report_custom(report_int):
         for f in fields:
             field_id = (f['field_child3'] and f['field_child3'][0]) or (f['field_child2'] and f['field_child2'][0]) or (f['field_child1'] and f['field_child1'][0]) or (f['field_child0'] and f['field_child0'][0])
             if field_id:
-                ttype = env['ir.model.fields'].browse(field_id).ttype
+                ttype = env['ir.model.fields'].sudo().browse(field_id).ttype
                 if ttype == 'date':
                     date_idx = idx
                     fct[idx] = process_date[report['frequency']] 
@@ -435,7 +435,7 @@ class report_custom(report_int):
         for f in fields:
             field_id = (f['field_child3'] and f['field_child3'][0]) or (f['field_child2'] and f['field_child2'][0]) or (f['field_child1'] and f['field_child1'][0]) or (f['field_child0'] and f['field_child0'][0])
             if field_id:
-                ttype = env['ir.model.fields'].browse(field_id).ttype
+                ttype = env['ir.model.fields'].sudo().browse(field_id).ttype
                 if ttype == 'date':
                     date_idx = idx
                     fct[idx] = process_date[report['frequency']]