From 098458daa8c72fc277f4d56dd6428f5642be7fdf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Thu, 12 Sep 2024 16:45:34 +0200
Subject: [PATCH] Move all access checks of report to check_access method

---
 trytond/doc/ref/report.rst       |  2 +-
 trytond/trytond/report/report.py | 48 +++++++++++++++++---------------
 2 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/trytond/doc/ref/report.rst b/trytond/doc/ref/report.rst
index 4b06b1cbf5..3198d2e07d 100644
--- a/trytond/doc/ref/report.rst
+++ b/trytond/doc/ref/report.rst
@@ -34,7 +34,7 @@ Class methods are:
 
    Registers the report.
 
-.. classmethod:: Report.check_access()
+.. classmethod:: Report.check_access(action, model, ids)
 
    Verifies if the :attr:`~trytond.transaction.Transaction.user` is allowed to
    execute the report.
diff --git a/trytond/trytond/report/report.py b/trytond/trytond/report/report.py
index 7df7dbd42f..61a8f673b8 100644
--- a/trytond/trytond/report/report.py
+++ b/trytond/trytond/report/report.py
@@ -141,26 +141,34 @@ class Report(URLMixin, PoolBase):
             }
 
     @classmethod
-    def check_access(cls):
+    def check_access(cls, action, model, ids):
         pool = Pool()
         ActionReport = pool.get('ir.action.report')
         User = pool.get('res.user')
         Group = pool.get('res.group')
+        ModelAccess = pool.get('ir.model.access')
 
         if Transaction().user == 0:
             return
 
-        groups = set(User.get_groups())
-        report_groups = ActionReport.get_groups(cls.__name__)
-        if report_groups and not groups & report_groups:
-            groups = Group.browse(User.get_groups())
-            raise AccessError(
-                gettext(
-                    'ir.msg_access_report_error',
-                    report=cls.__name__),
-                gettext(
-                    'ir.msg_context_groups',
-                    groups=', '.join(g.rec_name for g in groups)))
+        with check_access():
+            groups = set(User.get_groups())
+            report_groups = ActionReport.get_groups(cls.__name__, action.id)
+            if report_groups and not groups & report_groups:
+                groups = Group.browse(User.get_groups())
+                raise AccessError(
+                    gettext(
+                        'ir.msg_access_report_error',
+                        report=cls.__name__),
+                    gettext(
+                        'ir.msg_context_groups',
+                        groups=', '.join(g.rec_name for g in groups)))
+
+            if model:
+                Model = pool.get(model)
+                ModelAccess.check(model, 'read')
+                # Check read access
+                Model.read(ids, ['id'])
 
     @classmethod
     def header_key(cls, record):
@@ -180,8 +188,6 @@ class Report(URLMixin, PoolBase):
         '''
         pool = Pool()
         ActionReport = pool.get('ir.action.report')
-        ModelAccess = pool.get('ir.model.access')
-        cls.check_access()
         context = Transaction().context
         ids = list(map(int, ids))
 
@@ -195,6 +201,9 @@ class Report(URLMixin, PoolBase):
         else:
             action_report = ActionReport(action_id)
 
+        model = action_report.model or data.get('model')
+        cls.check_access(action_report, model, ids)
+
         def report_name(records, reserved_length=0):
             names = []
             name_length = 0
@@ -222,17 +231,10 @@ class Report(URLMixin, PoolBase):
                 name += '__' + str(record_count - len(names))
             return name
 
-        records = []
-        model = action_report.model or data.get('model')
         if model:
             records = cls._get_records(ids, model, data)
-
-        with check_access():
-            if model:
-                Model = pool.get(model)
-                ModelAccess.check(model, 'read')
-                # Check read access
-                Model.read(ids, ['id'])
+        else:
+            records = []
 
         if not records:
             groups = [[]]