From 9423c7e97de103b02bdbf7bcf40e32ba28f73ce1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Thu, 12 Sep 2024 16:09:39 +0200
Subject: [PATCH] Check read access of report records

Closes #13505
(grafted from cbd8e185bb320df9967fc41c542ef96c56ad548f)

--HG--
branch : 7.0
---
 trytond/CHANGELOG                |  1 +
 trytond/trytond/report/report.py | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index 8895f7bc43..319f44fc3d 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Check read access of report records (#13505)
 
 Version 7.0.17 - 2024-09-01
 ---------------------------
diff --git a/trytond/trytond/report/report.py b/trytond/trytond/report/report.py
index 5306b343ac..73b37c8016 100644
--- a/trytond/trytond/report/report.py
+++ b/trytond/trytond/report/report.py
@@ -37,7 +37,7 @@ from trytond.i18n import gettext
 from trytond.pool import Pool, PoolBase
 from trytond.rpc import RPC
 from trytond.tools import slugify
-from trytond.transaction import Transaction
+from trytond.transaction import Transaction, check_access
 from trytond.url import URLMixin
 
 try:
@@ -163,6 +163,7 @@ class Report(URLMixin, PoolBase):
         '''
         pool = Pool()
         ActionReport = pool.get('ir.action.report')
+        ModelAccess = pool.get('ir.model.access')
         cls.check_access()
         context = Transaction().context
         ids = list(map(int, ids))
@@ -209,6 +210,13 @@ class Report(URLMixin, PoolBase):
         if model:
             records = cls._get_records(ids, model, data)
 
+        with check_access():
+            if model:
+                Model = pool.get(model)
+                ModelAccess.check(model, 'read')
+                # Check read access
+                Model.read(ids, ['id'])
+
         if not records:
             groups = [[]]
             headers = [{}]