[12.0] muk_dms_file Potential file corruption, unintended deletion on DB duplication, rename and restore

[mkanderson]

Description: when 'Filestore Storage' is enabled, the full filesystem path to the documents is saved in the column 'muk_dms_file.content_file' with the following composition: data_dir + "/files/" + **db_name** + md5prefix + md5hash, for instance: '/var/lib/odoo/files/mydb/e2/e28088cf2ca59192b6d7b73508c0dd8e7783be73'

This is the fully qualified filesystem path on the host server, including the hard-coded name of the database.

This approach has two potentially dangerous flaws:

1. When a database is duplicated, renamed or restored, a new 'files/' folder is correctly created. However the paths in the database still point to the original files, so any operations, including unlink, are performed on these files, not the ones belonging to the new database.
2. By restoring a manipulated database, a user could potentially download any files to which the Odoo application user has access to. This is especially problematic with tenant systems.

Tested with:

• Odoo version 12.0-20200826 (https://github.com/odoo/docker/blob/1bddcda4b2ef30c7443ebe0cae43d17f92aa43cd/12.0/Dockerfile)
• https://github.com/muk-it/muk_dms/tree/12.0
• https://github.com/muk-it/muk_base/tree/12.0
• https://github.com/muk-it/muk_web/tree/12.0