Don't allow rpc call on ModelStorage without ModelView

CVE-2012-0215
issue2476
review307001

CHANGELOG

@@ -1,3 +1,5 @@
+* Don't allow rpc call on ModelStorage without ModelView (CVE-2012-0215)
+
 Version 2.2.1 - 2011-12-26
 * Bug fixes (see mercurial logs for details)
 

trytond/model/modelstorage.py

@@ -26,6 +26,7 @@ from trytond.transaction import Transaction
 from trytond.pool import Pool
 from trytond.cache import LRUDict
 from trytond.config import CONFIG
+from .modelview import ModelView
 
 
 class ModelStorage(Model):
@@ -42,18 +43,19 @@ class ModelStorage(Model):
 
     def __init__(self):
         super(ModelStorage, self).__init__()
-        self._rpc.update({
-            'create': True,
-            'read': False,
-            'write': True,
-            'delete': True,
-            'copy': True,
-            'search': False,
-            'search_count': False,
-            'search_read': False,
-            'export_data': False,
-            'import_data': True,
-        })
+        if isinstance(self, ModelView):
+            self._rpc.update({
+                'create': True,
+                'read': False,
+                'write': True,
+                'delete': True,
+                'copy': True,
+                'search': False,
+                'search_count': False,
+                'search_read': False,
+                'export_data': False,
+                'import_data': True,
+            })
         self._constraints = []
 
     def default_create_uid(self):

trytond/workflow/workflow.py

@@ -265,11 +265,6 @@ class WorkflowTransitionInstance(ModelSQL):
     inst_id = fields.Many2One('workflow.instance', 'Instance',
             ondelete='CASCADE', select=1, required=True)
 
-    def __init__(self):
-        super(WorkflowTransitionInstance, self).__init__()
-        for i in ('create', 'write', 'delete', 'copy'):
-            del self._rpc[i]
-
     def fields_get(self, fields_names=None):
         res = super(WorkflowTransitionInstance, self).fields_get(
                 fields_names=fields_names)