From 08ec032a2fade2111e7c532b9ef7b2d7f95ff913 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Wed, 28 Mar 2012 19:05:40 +0200
Subject: [PATCH] Don't allow rpc call on ModelStorage without ModelView

CVE-2012-0215
issue2476
review307001
---
 CHANGELOG                     |  2 ++
 trytond/model/modelstorage.py | 26 ++++++++++++++------------
 trytond/workflow/workflow.py  |  5 -----
 3 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 332b5dcd4e..ccda37dfe4 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,5 @@
+* Don't allow rpc call on ModelStorage without ModelView (CVE-2012-0215)
+
 Version 2.2.1 - 2011-12-26
 * Bug fixes (see mercurial logs for details)
 
diff --git a/trytond/model/modelstorage.py b/trytond/model/modelstorage.py
index eb168633e7..48598a0f56 100644
--- a/trytond/model/modelstorage.py
+++ b/trytond/model/modelstorage.py
@@ -26,6 +26,7 @@ from trytond.transaction import Transaction
 from trytond.pool import Pool
 from trytond.cache import LRUDict
 from trytond.config import CONFIG
+from .modelview import ModelView
 
 
 class ModelStorage(Model):
@@ -42,18 +43,19 @@ class ModelStorage(Model):
 
     def __init__(self):
         super(ModelStorage, self).__init__()
-        self._rpc.update({
-            'create': True,
-            'read': False,
-            'write': True,
-            'delete': True,
-            'copy': True,
-            'search': False,
-            'search_count': False,
-            'search_read': False,
-            'export_data': False,
-            'import_data': True,
-        })
+        if isinstance(self, ModelView):
+            self._rpc.update({
+                'create': True,
+                'read': False,
+                'write': True,
+                'delete': True,
+                'copy': True,
+                'search': False,
+                'search_count': False,
+                'search_read': False,
+                'export_data': False,
+                'import_data': True,
+            })
         self._constraints = []
 
     def default_create_uid(self):
diff --git a/trytond/workflow/workflow.py b/trytond/workflow/workflow.py
index 8f39e57e10..8bc0144aa2 100644
--- a/trytond/workflow/workflow.py
+++ b/trytond/workflow/workflow.py
@@ -265,11 +265,6 @@ class WorkflowTransitionInstance(ModelSQL):
     inst_id = fields.Many2One('workflow.instance', 'Instance',
             ondelete='CASCADE', select=1, required=True)
 
-    def __init__(self):
-        super(WorkflowTransitionInstance, self).__init__()
-        for i in ('create', 'write', 'delete', 'copy'):
-            del self._rpc[i]
-
     def fields_get(self, fields_names=None):
         res = super(WorkflowTransitionInstance, self).fields_get(
                 fields_names=fields_names)