From 458c26ae18e411fbf638e1df5f9a91a271e85177 Mon Sep 17 00:00:00 2001
From: Thibault Francois <tfr@openerp.com>
Date: Wed, 29 Jul 2020 11:55:03 +0000
Subject: [PATCH] [FIX] website_sale, payment: perf issue when displaying
 tokens

Problem:
the controller rely on record rules to select the payment.token
to be displayed on the payment page.
This works fine with portal user, but internal user
will face client side performance issue
as they can see all the token of the database

Solution:
Don't rely on record.rule in the controller. Use the domain
from the portal user rule in the search.

To make the search of token working for partners with more than
2 levels of hierachy, use child_of operator

closes odoo/odoo#56326

X-original-commit: 3999e249ea9902e009f0366949886e14e3d7fdf4
Related: odoo/enterprise#12579
Signed-off-by: Damien Bouvy (dbo) <dbo@odoo.com>
---
 addons/payment/security/payment_security.xml | 2 +-
 addons/website_sale/controllers/main.py      | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/addons/payment/security/payment_security.xml b/addons/payment/security/payment_security.xml
index 4e63760ada3..e51b25f981a 100644
--- a/addons/payment/security/payment_security.xml
+++ b/addons/payment/security/payment_security.xml
@@ -10,7 +10,7 @@
     <record id="payment_token_user_rule" model="ir.rule">
         <field name="name">Access own payment tokens only</field>
         <field name="model_id" ref="payment.model_payment_token"/>
-        <field name="domain_force">['|', ('partner_id','=',user.partner_id.id), ('partner_id', '=', user.partner_id.commercial_partner_id.id)]</field>
+        <field name="domain_force">[('partner_id', 'child_of', user.partner_id.commercial_partner_id.id)]</field>
         <field name="groups" eval="[(4, ref('base.group_user')), (4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
     </record>
 
diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py
index 29caf458371..49ec6300129 100644
--- a/addons/website_sale/controllers/main.py
+++ b/addons/website_sale/controllers/main.py
@@ -838,8 +838,9 @@ class WebsiteSale(http.Controller):
         values['access_token'] = order.access_token
         values['acquirers'] = [acq for acq in acquirers if (acq.payment_flow == 'form' and acq.view_template_id) or
                                     (acq.payment_flow == 's2s' and acq.registration_view_template_id)]
-        values['tokens'] = request.env['payment.token'].search(
-            [('acquirer_id', 'in', acquirers.ids)])
+        values['tokens'] = request.env['payment.token'].search([
+            ('acquirer_id', 'in', acquirers.ids),
+            ('partner_id', 'child_of', order.partner_id.commercial_partner_id.id)])
 
         if order:
             values['acq_extra_fees'] = acquirers.get_acquirer_extra_fees(order.amount_total, order.currency_id, order.partner_id.country_id.id)