[IMP] payment_payumoney, payment_stripe: set private fields accessible to employees only

In 8.0 private fields have been recently set as visible only to employees
at commit b226510840.

However between v9 and v10 two new payment acquirers have been implemented
payumoney and stripe. Those addons now have their credential set as private.

Methods using the acquirers have been sudoed accordingly to avoid access
issues when rendering the buttons. Other payment modules will be updated when
the forward port from 8 to 9 and pre-10-master will be done.

addons/payment_payumoney/models/payment.py

@@ -17,8 +17,8 @@ class PaymentAcquirerPayumoney(models.Model):
     _inherit = 'payment.acquirer'
 
     provider = fields.Selection(selection_add=[('payumoney', 'PayUmoney')])
-    payumoney_merchant_key = fields.Char(string='Merchant Key', required_if_provider='payumoney')
-    payumoney_merchant_salt = fields.Char(string='Merchant Salt', required_if_provider='payumoney')
+    payumoney_merchant_key = fields.Char(string='Merchant Key', required_if_provider='payumoney', groups='base.group_user')
+    payumoney_merchant_salt = fields.Char(string='Merchant Salt', required_if_provider='payumoney', groups='base.group_user')
 
     def _get_payumoney_urls(self, environment):
         """ PayUmoney URLs"""

addons/payment_stripe/models/payment.py

@@ -20,10 +20,10 @@ class PaymentAcquirerStripe(models.Model):
     _inherit = 'payment.acquirer'
 
     provider = fields.Selection(selection_add=[('stripe', 'Stripe')])
-    stripe_secret_key = fields.Char(required_if_provider='stripe')
-    stripe_publishable_key = fields.Char(required_if_provider='stripe')
+    stripe_secret_key = fields.Char(required_if_provider='stripe', groups='base.group_user')
+    stripe_publishable_key = fields.Char(required_if_provider='stripe', groups='base.group_user')
     stripe_image_url = fields.Char(
-        "Checkout Image URL",
+        "Checkout Image URL", groups='base.group_user',
         help="A relative or absolute URL pointing to a square image of your "
              "brand or product. As defined in your Stripe profile. See: "
              "https://stripe.com/docs/checkout")

addons/website_payment/controllers/main.py

@@ -48,7 +48,7 @@ class WebsitePayment(http.Controller):
 
         partner_id = user.partner_id.id if user.partner_id.id != request.website.partner_id.id else False
 
-        payment_form = acquirer.render(reference, float(amount), currency.id, values={'return_url': '/website_payment/confirm', 'partner_id': partner_id})
+        payment_form = acquirer.sudo().render(reference, float(amount), currency.id, values={'return_url': '/website_payment/confirm', 'partner_id': partner_id})
         values = {
             'reference': reference,
             'acquirer': acquirer,