pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "[FIX] account_payment: Restrain access to invoice's partner"

Browse Source 
This reverts commit 55878df5ff.
This commit is contained in:
Toufik Benjaa
2018-04-11 12:26:41 +02:00
parent 7516d9bb7f
commit 0c9eabb0a9
1 changed files with 17 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/account_payment/controllers/payment.py
+17 -13
View File
@@ -8,7 +8,7 @@ from odoo.http import request, route
class PaymentPortal(http.Controller):
@route('/invoice/pay/<int:invoice_id>/form_tx', type='json', auth="user", website=True)
@route('/invoice/pay/<int:invoice_id>/form_tx', type='json', auth="public", website=True)
def invoice_pay_form(self, acquirer_id, invoice_id, save_token=False, access_token=None, **kwargs):
""" Json method that creates a payment.transaction, used to create a
transaction when the user clicks on 'pay now' button on the payment
@@ -17,13 +17,11 @@ class PaymentPortal(http.Controller):
:return html: form containing all values related to the acquirer to
redirect customers to the acquirer website """
success_url = kwargs.get('success_url', '/my')
callback_method = kwargs.get('callback_method', '')
invoice_sudo = request.env['account.invoice'].sudo().browse(invoice_id)
if not invoice_sudo:
return False
# Check if the current user has access to this invoice
commercial_partner_id = request.env.user.partner_id.commercial_partner_id.id
if request.env['account.invoice'].sudo().search_count([('id', '=', invoice_id), ('message_partner_ids', 'child_of', commercial_partner_id)]) == 0:
return False
try:
acquirer = request.env['payment.acquirer'].browse(int(acquirer_id))
@@ -35,7 +33,12 @@ class PaymentPortal(http.Controller):
invoice_sudo,
acquirer,
payment_token=token,
tx_type='form_save' if save_token else 'form')
tx_type='form_save' if save_token else 'form',
add_tx_values={
'callback_model_id': request.env['ir.model'].sudo().search([('model', '=', invoice_sudo._name)], limit=1).id,
'callback_res_id': invoice_sudo.id,
'callback_method': callback_method,
})
# set the transaction id into the session
request.session['portal_invoice_%s_transaction_id' % invoice_sudo.id] = tx.id
@@ -50,11 +53,12 @@ class PaymentPortal(http.Controller):
}
)
@http.route('/invoice/pay/<int:invoice_id>/s2s_token_tx', type='http', auth='user', website=True)
@http.route('/invoice/pay/<int:invoice_id>/s2s_token_tx', type='http', auth='public', website=True)
def invoice_pay_token(self, invoice_id, pm_id=None, **kwargs):
""" Use a token to perform a s2s transaction """
error_url = kwargs.get('error_url', '/my')
success_url = kwargs.get('success_url', '/my')
callback_method = kwargs.get('callback_method', '')
access_token = kwargs.get('access_token')
params = {}
if access_token:
@@ -65,11 +69,6 @@ class PaymentPortal(http.Controller):
params['error'] = 'pay_invoice_invalid_doc'
return request.redirect(_build_url_w_params(error_url, params))
# Check if the current user has access to this invoice
commercial_partner_id = request.env.user.partner_id.commercial_partner_id.id
if request.env['account.invoice'].sudo().search_count([('id', '=', invoice_id), ('message_partner_ids', 'child_of', commercial_partner_id)]) == 0:
return False
try:
token = request.env['payment.token'].sudo().browse(int(pm_id))
except (ValueError, TypeError):
@@ -83,7 +82,12 @@ class PaymentPortal(http.Controller):
invoice_sudo,
token.acquirer_id,
payment_token=token,
tx_type='server2server')
tx_type='server2server',
add_tx_values={
'callback_model_id': request.env['ir.model'].sudo().search([('model', '=', invoice_sudo._name)], limit=1).id,
'callback_res_id': invoice_sudo.id,
'callback_method': callback_method,
})
# set the transaction id into the session
request.session['portal_invoice_%s_transaction_id' % invoice_sudo.id] = tx.id