From 01b47f30c849e59ef2fc5dbc561fa51f3585a37a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Thu, 21 Sep 2023 17:55:29 +0200
Subject: [PATCH] Remove own view search access rules

Instead we use dedicated get/set/unset methods which enforce access rights.
---
 sao/src/common.js              | 17 ++++-----
 tryton/tryton/common/common.py | 16 ++++-----
 trytond/trytond/ir/ui/view.py  | 33 +++++++++++++++---
 trytond/trytond/res/ir.xml     | 63 +++++++---------------------------
 4 files changed, 54 insertions(+), 75 deletions(-)

diff --git a/sao/src/common.js b/sao/src/common.js
index 57006fac17..7653413817 100644
--- a/sao/src/common.js
+++ b/sao/src/common.js
@@ -583,7 +583,7 @@
         load_searches: function() {
             this.searches = {};
             return Sao.rpc({
-                'method': 'model.ir.ui.view_search.get_search',
+                'method': 'model.ir.ui.view_search.get',
                 'params': [{}]
             }, Sao.Session.current_session).then(searches => {
                 this.searches = searches;
@@ -594,14 +594,9 @@
         },
         add: function(model, name, domain) {
             return Sao.rpc({
-                'method': 'model.ir.ui.view_search.create',
-                'params': [[{
-                    'model': model,
-                    'name': name,
-                    'domain': this.encoder.encode(domain)
-                }], {}]
-            }, Sao.Session.current_session).then(ids => {
-                var id = ids[0];
+                'method': 'model.ir.ui.view_search.set',
+                'params': [name, model, this.encoder.encode(domain), {}],
+            }, Sao.Session.current_session).then(id => {
                 if (this.searches[model] === undefined) {
                     this.searches[model] = [];
                 }
@@ -610,8 +605,8 @@
         },
         remove: function(model, id) {
             return Sao.rpc({
-                'method': 'model.ir.ui.view_search.delete',
-                'params': [[id], {}]
+                'method': 'model.ir.ui.view_search.unset',
+                'params': [id, {}]
             }, Sao.Session.current_session).then(() => {
                 for (var i = 0; i < this.searches[model].length; i++) {
                     var domain = this.searches[model][i];
diff --git a/tryton/tryton/common/common.py b/tryton/tryton/common/common.py
index 2d2f2bcb13..ac39e3549b 100644
--- a/tryton/tryton/common/common.py
+++ b/tryton/tryton/common/common.py
@@ -323,9 +323,8 @@ class ViewSearch(object):
 
     def load_searches(self):
         try:
-            self.searches = rpc.execute('model', 'ir.ui.view_search',
-                'get_search', rpc.CONTEXT)
-        except TrytonServerError:
+            self.searches = RPCExecute('model', 'ir.ui.view_search', 'get')
+        except RPCException:
             self.searches = {}
 
     def __getitem__(self, model):
@@ -333,19 +332,16 @@ class ViewSearch(object):
 
     def add(self, model, name, domain):
         try:
-            id_, = RPCExecute('model', 'ir.ui.view_search',
-                'create', [{
-                        'model': model,
-                        'name': name,
-                        'domain': self.encoder.encode(domain),
-                        }])
+            id_ = RPCExecute(
+                'model', 'ir.ui.view_search', 'set',
+                name, model, self.encoder.encode(domain))
         except RPCException:
             return
         self.searches.setdefault(model, []).append((id_, name, domain, True))
 
     def remove(self, model, id_):
         try:
-            RPCExecute('model', 'ir.ui.view_search', 'delete', [id_])
+            RPCExecute('model', 'ir.ui.view_search', 'unset', id_)
         except RPCException:
             return
         for i, domain in enumerate(self.searches[model]):
diff --git a/trytond/trytond/ir/ui/view.py b/trytond/trytond/ir/ui/view.py
index 871a10437d..fd875cfba7 100644
--- a/trytond/trytond/ir/ui/view.py
+++ b/trytond/trytond/ir/ui/view.py
@@ -606,7 +606,9 @@ class ViewSearch(ModelSQL, ModelView):
     def __setup__(cls):
         super(ViewSearch, cls).__setup__()
         cls.__rpc__.update({
-                'get_search': RPC(),
+                'get': RPC(check_access=False),
+                'set': RPC(check_access=False, readonly=False),
+                'unset': RPC(check_access=False, readonly=False),
                 })
 
     @classmethod
@@ -660,10 +662,14 @@ class ViewSearch(ModelSQL, ModelView):
                             search=search.rec_name)) from exception
 
     @classmethod
-    def get_search(cls):
+    def get(cls):
         decoder = PYSONDecoder()
-        searches = cls.search_read(
-            [], order=[('model', 'ASC'), ('name', 'ASC')],
+        user = Transaction().user
+        searches = cls.search_read(['OR',
+                ('user', '=', user),
+                ('user', '=', None),
+                ],
+            order=[('model', 'ASC'), ('name', 'ASC')],
             fields_names=['id', 'name', 'model', 'domain', '_delete'])
         result = {}
         for search in searches:
@@ -673,3 +679,22 @@ class ViewSearch(ModelSQL, ModelView):
                     decoder.decode(search['domain']),
                     search['_delete']))
         return result
+
+    @classmethod
+    def set(cls, name, model, domain):
+        user = Transaction().user
+        search, = cls.create([{
+                    'name': name,
+                    'model': model,
+                    'domain': domain,
+                    'user': user,
+                    }])
+        return search.id
+
+    @classmethod
+    def unset(cls, id):
+        user = Transaction().user
+        cls.delete(cls.search([
+                    ('id', '=', id),
+                    ('user', '=', user),
+                    ]))
diff --git a/trytond/trytond/res/ir.xml b/trytond/trytond/res/ir.xml
index c1eed7a189..77cb7b767d 100644
--- a/trytond/trytond/res/ir.xml
+++ b/trytond/trytond/res/ir.xml
@@ -388,57 +388,20 @@ this repository contains the full copyright notices and license terms. -->
             <field name="perm_delete" eval="True" />
         </record>
 
-        <record model="ir.rule.group" id="rule_group_view_search">
-            <field name="name">Own view search</field>
-            <field name="model"
-                search="[('model', '=', 'ir.ui.view_search')]"/>
-            <field name="global_p" eval="False"/>
-            <field name="default_p" eval="True"/>
-            <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="True"/>
-            <field name="perm_create" eval="True"/>
-            <field name="perm_delete" eval="True"/>
+        <record model="ir.model.access" id="access_ir_ui_view_search">
+            <field name="model" search="[('model', '=', 'ir.ui.view_search')]" />
+            <field name="perm_read" eval="False" />
+            <field name="perm_write" eval="False" />
+            <field name="perm_create" eval="False" />
+            <field name="perm_delete" eval="False" />
         </record>
-        <record model="ir.rule" id="rule_group_view_search1">
-            <field name="domain"
-                eval="[('user', '=', Eval('user', {}).get('id', -1))]"
-                pyson="1"/>
-            <field name="rule_group" ref="rule_group_view_search"/>
-        </record>
-
-        <record model="ir.rule.group" id="rule_group_view_search_common">
-            <field name="name">Common view search</field>
-            <field name="model" search="[('model', '=', 'ir.ui.view_search')]"/>
-            <field name="global_p" eval="False"/>
-            <field name="default_p" eval="True"/>
-            <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="False"/>
-            <field name="perm_create" eval="False"/>
-            <field name="perm_delete" eval="False"/>
-        </record>
-        <record model="ir.rule" id="rule_group_view_search_common1">
-            <field
-                name="domain"
-                eval="[('user', '=', None)]"
-                pyson="1"/>
-            <field name="rule_group" ref="rule_group_view_search_common"/>
-        </record>
-
-        <record model="ir.rule.group" id="rule_group_view_search_admin">
-            <field name="name">Any view search</field>
-            <field name="model"
-                search="[('model', '=', 'ir.ui.view_search')]"/>
-            <field name="global_p" eval="False"/>
-            <field name="default_p" eval="False"/>
-            <field name="perm_read" eval="True"/>
-            <field name="perm_write" eval="True"/>
-            <field name="perm_create" eval="True"/>
-            <field name="perm_delete" eval="True"/>
-        </record>
-        <record model="ir.rule.group-res.group"
-            id="rule_group_view_search_admin_group_admin">
-            <field name="rule_group" ref="rule_group_view_search_admin"/>
-            <field name="group" ref="group_admin"/>
+        <record model="ir.model.access" id="access_ir_ui_view_search_admin">
+            <field name="model" search="[('model', '=', 'ir.ui.view_search')]" />
+            <field name="group" ref="res.group_admin" />
+            <field name="perm_read" eval="True" />
+            <field name="perm_write" eval="True" />
+            <field name="perm_create" eval="True" />
+            <field name="perm_delete" eval="True" />
         </record>
 
         <record model="ir.model.access" id="access_message">