Ignore link of action that user can not read

We must also prevent the client to read link action for which the user has not
read access.

issue9364
review305661002

trytond/model/modelview.py

@@ -646,8 +646,12 @@ class ModelView(Model):
         if element.tag == 'link':
             link_name = element.attrib['name']
             action_id = ModelData.get_id(*link_name.split('.'))
-            action = ActionWindow(action_id)
-            if (not action.res_model
+            try:
+                action, = ActionWindow.search([('id', '=', action_id)])
+            except ValueError:
+                action = None
+            if (not action
+                    or not action.res_model
                     or not ModelAccess.check(
                         action.res_model, 'read', raise_exception=False)):
                 element.tag = 'label'

trytond/tests/test_modelview.py

@@ -419,6 +419,32 @@ class ModelView(unittest.TestCase):
         self.assertFalse(links)
         self.assertTrue(labels)
 
+    @with_transaction()
+    def test_link_without_action_access(self):
+        "Test link in view without action access"
+        pool = Pool()
+        TestModel = pool.get('test.modelview.link')
+        ActionWindow = pool.get('ir.action.act_window')
+        Group = pool.get('res.group')
+        ActionGroup = pool.get('ir.action-res.group')
+
+        group = Group(name="Group")
+        group.save()
+        action_window, = ActionWindow.search(
+            [('res_model', '=', 'test.modelview.link.target')])
+        ActionGroup(
+            action=action_window.action,
+            group=group).save()
+
+        arch = TestModel.fields_view_get()['arch']
+        parser = etree.XMLParser()
+        tree = etree.fromstring(arch, parser=parser)
+        links = tree.xpath('//link')
+        labels = tree.xpath('//label')
+
+        self.assertFalse(links)
+        self.assertTrue(labels)
+
     @with_transaction()
     def test_rpc_setup(self):
         "Testing the computation of the RPC methods"