[FIX] util.update_record_from_xml: stricter XPath expression

Only select elements known to define a records.

When building the XML tree that will be loaded, we use the `.append()`
which actually *move* the node.
The previous XPath expression matched any element having a corresponding
`id` attribute.
This conditions lead to a situation where the wanted record loose any
element having a matching `id`.

As show by the added test, updating the `web.login` template lead to
loading the following XML file:

```xml
<openerp><data>
  <template id="web.login">
    <...>
  </template>

  <input type="text" name="login" id="login"/>
</data></openerp>
```

Given that unknown tags are ignored, this error was silent.

Part of odoo/upgrade#5267

Courtesy-of: Arnaud Baes <[email protected]>
Courtesy-of: Paul Morelle <[email protected]>
Signed-off-by: Christophe Simonis (chs) <[email protected]>

Author: KangOl

src/base/tests/test_util.py

@@ -757,6 +757,18 @@ def test_update_record_from_xml__from_module(self):
         # web.layout should NOT have been updated
         self.assertEqual(layout.name, new_name)
 
+    def test_update_record_from_xml_bad_match(self):
+        cr = self.env.cr
+        if not util.module_installed(cr, "web"):
+            self.skip()
+
+        xmlid = "web.login"
+        util.update_record_from_xml(cr, xmlid)
+
+        arch = self.env.ref(xmlid).arch_db
+        tree = etree.fromstring(arch)
+        self.assertIsNotNone(tree.find(".//input[@id='login']"))
+
     def test_ensure_xmlid_match_record(self):
         cr = self.env.cr
         tx1 = self.env["res.currency"].create({"name": "TX1", "symbol": "TX1"})

src/util/records.py

@@ -756,7 +756,7 @@ def update_record_from_xml(
         if module == from_module
         else "@id='{module}.{name}'".format(module=module, name=name)
     )
-    xpath = "//*[{}]".format(id_match)
+    xpath = "//*[self::act_window or self::menuitem or self::record or self::report or self::template][{}]".format(id_match)  # fmt: skip
 
     # use a data tag inside openerp tag to be compatible with all supported versions
     new_root = lxml.etree.fromstring("<openerp><data/></openerp>")