From 0c9eabb0a965b4eaa0e0d1f4854b0cd27b3fc9ee Mon Sep 17 00:00:00 2001
From: Toufik Benjaa <tbe@odoo.com>
Date: Wed, 11 Apr 2018 12:26:41 +0200
Subject: [PATCH] Revert "[FIX] account_payment: Restrain access to invoice's
 partner"

This reverts commit 55878df5fff0e6da926e4503b13a51052a4201e0.
---
 addons/account_payment/controllers/payment.py | 30 +++++++++++--------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/addons/account_payment/controllers/payment.py b/addons/account_payment/controllers/payment.py
index e2a5e6dbea9..2916a512b51 100644
--- a/addons/account_payment/controllers/payment.py
+++ b/addons/account_payment/controllers/payment.py
@@ -8,7 +8,7 @@ from odoo.http import request, route
 
 class PaymentPortal(http.Controller):
 
-    @route('/invoice/pay/<int:invoice_id>/form_tx', type='json', auth="user", website=True)
+    @route('/invoice/pay/<int:invoice_id>/form_tx', type='json', auth="public", website=True)
     def invoice_pay_form(self, acquirer_id, invoice_id, save_token=False, access_token=None, **kwargs):
         """ Json method that creates a payment.transaction, used to create a
         transaction when the user clicks on 'pay now' button on the payment
@@ -17,13 +17,11 @@ class PaymentPortal(http.Controller):
         :return html: form containing all values related to the acquirer to
                       redirect customers to the acquirer website """
         success_url = kwargs.get('success_url', '/my')
+        callback_method = kwargs.get('callback_method', '')
+
         invoice_sudo = request.env['account.invoice'].sudo().browse(invoice_id)
         if not invoice_sudo:
             return False
-        # Check if the current user has access to this invoice
-        commercial_partner_id = request.env.user.partner_id.commercial_partner_id.id
-        if request.env['account.invoice'].sudo().search_count([('id', '=', invoice_id), ('message_partner_ids', 'child_of', commercial_partner_id)]) == 0:
-            return False
 
         try:
             acquirer = request.env['payment.acquirer'].browse(int(acquirer_id))
@@ -35,7 +33,12 @@ class PaymentPortal(http.Controller):
             invoice_sudo,
             acquirer,
             payment_token=token,
-            tx_type='form_save' if save_token else 'form')
+            tx_type='form_save' if save_token else 'form',
+            add_tx_values={
+                'callback_model_id': request.env['ir.model'].sudo().search([('model', '=', invoice_sudo._name)], limit=1).id,
+                'callback_res_id': invoice_sudo.id,
+                'callback_method': callback_method,
+            })
 
         # set the transaction id into the session
         request.session['portal_invoice_%s_transaction_id' % invoice_sudo.id] = tx.id
@@ -50,11 +53,12 @@ class PaymentPortal(http.Controller):
             }
         )
 
-    @http.route('/invoice/pay/<int:invoice_id>/s2s_token_tx', type='http', auth='user', website=True)
+    @http.route('/invoice/pay/<int:invoice_id>/s2s_token_tx', type='http', auth='public', website=True)
     def invoice_pay_token(self, invoice_id, pm_id=None, **kwargs):
         """ Use a token to perform a s2s transaction """
         error_url = kwargs.get('error_url', '/my')
         success_url = kwargs.get('success_url', '/my')
+        callback_method = kwargs.get('callback_method', '')
         access_token = kwargs.get('access_token')
         params = {}
         if access_token:
@@ -65,11 +69,6 @@ class PaymentPortal(http.Controller):
             params['error'] = 'pay_invoice_invalid_doc'
             return request.redirect(_build_url_w_params(error_url, params))
 
-        # Check if the current user has access to this invoice
-        commercial_partner_id = request.env.user.partner_id.commercial_partner_id.id
-        if request.env['account.invoice'].sudo().search_count([('id', '=', invoice_id), ('message_partner_ids', 'child_of', commercial_partner_id)]) == 0:
-            return False
-
         try:
             token = request.env['payment.token'].sudo().browse(int(pm_id))
         except (ValueError, TypeError):
@@ -83,7 +82,12 @@ class PaymentPortal(http.Controller):
             invoice_sudo,
             token.acquirer_id,
             payment_token=token,
-            tx_type='server2server')
+            tx_type='server2server',
+            add_tx_values={
+                'callback_model_id': request.env['ir.model'].sudo().search([('model', '=', invoice_sudo._name)], limit=1).id,
+                'callback_res_id': invoice_sudo.id,
+                'callback_method': callback_method,
+            })
 
         # set the transaction id into the session
         request.session['portal_invoice_%s_transaction_id' % invoice_sudo.id] = tx.id