From 5bd4218454f353d1c766f06b47c104e366dbc8d5 Mon Sep 17 00:00:00 2001
From: Ravi Gohil <rgo@odoo.com>
Date: Tue, 6 Sep 2016 11:11:36 +0200
Subject: [PATCH] [IMP] payment_payumoney, payment_stripe: set private fields
 accessible to employees only

In 8.0 private fields have been recently set as visible only to employees
at commit b2265108406e0dc1d1e1250fdbad5bc2cee2006d.

However between v9 and v10 two new payment acquirers have been implemented
payumoney and stripe. Those addons now have their credential set as private.

Methods using the acquirers have been sudoed accordingly to avoid access
issues when rendering the buttons. Other payment modules will be updated when
the forward port from 8 to 9 and pre-10-master will be done.
---
 addons/payment_payumoney/models/payment.py | 4 ++--
 addons/payment_stripe/models/payment.py    | 6 +++---
 addons/website_payment/controllers/main.py | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/addons/payment_payumoney/models/payment.py b/addons/payment_payumoney/models/payment.py
index 38d89c2c7f9..0a1d3d6b943 100644
--- a/addons/payment_payumoney/models/payment.py
+++ b/addons/payment_payumoney/models/payment.py
@@ -17,8 +17,8 @@ class PaymentAcquirerPayumoney(models.Model):
     _inherit = 'payment.acquirer'
 
     provider = fields.Selection(selection_add=[('payumoney', 'PayUmoney')])
-    payumoney_merchant_key = fields.Char(string='Merchant Key', required_if_provider='payumoney')
-    payumoney_merchant_salt = fields.Char(string='Merchant Salt', required_if_provider='payumoney')
+    payumoney_merchant_key = fields.Char(string='Merchant Key', required_if_provider='payumoney', groups='base.group_user')
+    payumoney_merchant_salt = fields.Char(string='Merchant Salt', required_if_provider='payumoney', groups='base.group_user')
 
     def _get_payumoney_urls(self, environment):
         """ PayUmoney URLs"""
diff --git a/addons/payment_stripe/models/payment.py b/addons/payment_stripe/models/payment.py
index 59f9b1a8c82..3e9958a78f6 100644
--- a/addons/payment_stripe/models/payment.py
+++ b/addons/payment_stripe/models/payment.py
@@ -20,10 +20,10 @@ class PaymentAcquirerStripe(models.Model):
     _inherit = 'payment.acquirer'
 
     provider = fields.Selection(selection_add=[('stripe', 'Stripe')])
-    stripe_secret_key = fields.Char(required_if_provider='stripe')
-    stripe_publishable_key = fields.Char(required_if_provider='stripe')
+    stripe_secret_key = fields.Char(required_if_provider='stripe', groups='base.group_user')
+    stripe_publishable_key = fields.Char(required_if_provider='stripe', groups='base.group_user')
     stripe_image_url = fields.Char(
-        "Checkout Image URL",
+        "Checkout Image URL", groups='base.group_user',
         help="A relative or absolute URL pointing to a square image of your "
              "brand or product. As defined in your Stripe profile. See: "
              "https://stripe.com/docs/checkout")
diff --git a/addons/website_payment/controllers/main.py b/addons/website_payment/controllers/main.py
index ed7c0ade11d..dd4ef720e16 100644
--- a/addons/website_payment/controllers/main.py
+++ b/addons/website_payment/controllers/main.py
@@ -48,7 +48,7 @@ class WebsitePayment(http.Controller):
 
         partner_id = user.partner_id.id if user.partner_id.id != request.website.partner_id.id else False
 
-        payment_form = acquirer.render(reference, float(amount), currency.id, values={'return_url': '/website_payment/confirm', 'partner_id': partner_id})
+        payment_form = acquirer.sudo().render(reference, float(amount), currency.id, values={'return_url': '/website_payment/confirm', 'partner_id': partner_id})
         values = {
             'reference': reference,
             'acquirer': acquirer,