From 1e48332176284c855395ba0bc9b564cd33332070 Mon Sep 17 00:00:00 2001
From: Florent de Labarre <florent.mirieu@gmail.com>
Date: Tue, 21 Feb 2023 08:58:09 +0000
Subject: [PATCH] [FIX] account: portal user can show not finished invoice

- Create an Order, send to customer
- Create an invoice from this sale
--> Issue the customer can show the invoice in draft mode
This prevent customer to print a draft invoice with wrong value.

Only show send invoice.

closes odoo/odoo#114765

X-original-commit: 687f479297fcaa047cd26a34883e7de11b3d3dea
Signed-off-by: Olivier Colson (oco) <oco@odoo.com>
---
 addons/account/controllers/portal.py         | 2 +-
 addons/account/security/account_security.xml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/addons/account/controllers/portal.py b/addons/account/controllers/portal.py
index a1da371aec1..10f7eba11dd 100644
--- a/addons/account/controllers/portal.py
+++ b/addons/account/controllers/portal.py
@@ -31,7 +31,7 @@ class PortalAccount(CustomerPortal):
         return self._get_page_view_values(invoice, access_token, values, 'my_invoices_history', False, **kwargs)
 
     def _get_invoices_domain(self):
-        return [('move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund', 'out_receipt', 'in_receipt'))]
+        return [('state', 'not in', ('cancel', 'draft')), ('is_move_sent', '=', True), ('move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund', 'out_receipt', 'in_receipt'))]
 
     def _get_account_searchbar_sortings(self):
         return {
diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml
index 035b468a19d..29dbdb49f09 100644
--- a/addons/account/security/account_security.xml
+++ b/addons/account/security/account_security.xml
@@ -219,14 +219,14 @@
     <record id="account_invoice_rule_portal" model="ir.rule">
         <field name="name">Portal Personal Account Invoices</field>
         <field name="model_id" ref="account.model_account_move"/>
-        <field name="domain_force">[('move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), ('message_partner_ids','child_of',[user.commercial_partner_id.id])]</field>
+        <field name="domain_force">[('state', 'not in', ('cancel', 'draft')), ('is_move_sent', '=', True), ('move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), ('message_partner_ids','child_of',[user.commercial_partner_id.id])]</field>
         <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
     </record>
 
     <record id="account_invoice_line_rule_portal" model="ir.rule">
         <field name="name">Portal Invoice Lines</field>
         <field name="model_id" ref="account.model_account_move_line"/>
-        <field name="domain_force">[('move_id.move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), ('move_id.message_partner_ids','child_of',[user.commercial_partner_id.id])]</field>
+        <field name="domain_force">[('parent_state', 'not in', ('cancel', 'draft')), ('move_id.is_move_sent', '=', True), ('move_id.move_type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), ('move_id.message_partner_ids','child_of',[user.commercial_partner_id.id])]</field>
         <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
     </record>