Enforce access check in HTML editor route

Use .read and .write instead of .browse and .save when editing field via the
HTML editor.

Closes #14364

trytond/CHANGELOG

@@ -1,3 +1,4 @@
+* Enforce access check in HTML editor route (issue14364)
 * Add a clear cache method to the Database
 * Add sequence_reorder to model order
 * Remove has_window_functions from Database

trytond/trytond/ir/routes.py

@@ -48,20 +48,21 @@ def html_editor(request, pool, model, record, field):
     with transaction.set_context(language=language):
         Model = pool.get(model)
         record = Model(record)
+        values = Model.read([record.id], ['rec_name', field.name])[0]
 
         status = HTTPStatus.OK
         error = ''
         if request.method == 'POST':
             setattr(record, field.name, request.form['text'])
             if request.form['_csrf_token'] == get_token(record):
-                record.save()
+                Model.write([record], {field.name: request.form['text']})
                 return redirect(request.url)
             else:
                 status = HTTPStatus.BAD_REQUEST
                 error = gettext('ir.msg_html_editor_save_fail')
 
         csrf_token = get_token(record)
-        text = getattr(record, field.name) or ''
+        text = values[field.name] or ''
         if isinstance(text, bytes):
             try:
                 text = text.decode('utf-8')
@@ -72,7 +73,7 @@ def html_editor(request, pool, model, record, field):
             abort(HTTPStatus.BAD_REQUEST)
         title = '%(model)s "%(name)s" %(field)s - %(title)s' % {
             'model': field.model_ref.name,
-            'name': record.rec_name,
+            'name': values['rec_name'],
             'field': field.string,
             'title': request.args.get('title', "Tryton"),
             }