[12.0][IMP] kpi_dashboard: Compute the KPI on a separate cursor and rollback it

kpi_dashboard/models/kpi_kpi.py

@@ -1,9 +1,11 @@
 # Copyright 2020 Creu Blanca
 # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
 
-from odoo import api, fields, models
+from odoo import api, fields, models, _
+from odoo.exceptions import ValidationError
 import ast
 from odoo.tools.safe_eval import safe_eval
+import re
 
 
 class KpiKpi(models.Model):
@@ -89,12 +91,28 @@ class KpiKpi(models.Model):
     def _get_code_input_dict(self):
         return {
             "self": self,
-            "model": self,
+            "model": self.browse(),
         }
 
+    def _forbidden_code(self):
+        return ["commit", "rollback", "getattr", "execute"]
+
     def _compute_value_code(self):
+        forbidden = self._forbidden_code()
+        search_terms = "(" + ("|".join(forbidden)) + ")"
+        if re.search(search_terms, (self.code or "").lower()):
+            message = ", ".join(forbidden[:-1]) or ""
+            if len(message) > 0:
+                message += _(" or ")
+            message += forbidden[-1]
+            raise ValidationError(_(
+                "The code cannot contain the following terms: %s."
+            ) % message)
         results = self._get_code_input_dict()
+        savepoint = "kpi_formula_%s" % self.id
+        self.env.cr.execute("savepoint %s" % savepoint)
         safe_eval(self.code or "", results, mode="exec", nocopy=True)
+        self.env.cr.execute("rollback to %s" % savepoint)
         return results.get("result", {})