From 8781e2e4f8cf2d801d6f7f39a86a3bf63f8ad9da Mon Sep 17 00:00:00 2001
From: Nicolas Martinelli <nim@odoo.com>
Date: Fri, 25 Jan 2019 13:34:32 +0000
Subject: [PATCH] [FIX] payment: multiple companies

- Activate multi-company
- Create 2 S2S payment methods (Payment Flow: Payment from Odoo), one
  for each company
- Connect as a regular user to `/my/payment_method`

The user has access to both payment methods, while he should only have
access to the method of his company.

opw-1920483

closes odoo/odoo#30558
---
 addons/payment/controllers/portal.py              | 5 ++++-
 addons/payment/views/payment_portal_templates.xml | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/addons/payment/controllers/portal.py b/addons/payment/controllers/portal.py
index ba2a2551892..516eb8712a9 100644
--- a/addons/payment/controllers/portal.py
+++ b/addons/payment/controllers/portal.py
@@ -100,7 +100,10 @@ class PaymentProcessing(http.Controller):
 class WebsitePayment(http.Controller):
     @http.route(['/my/payment_method'], type='http', auth="user", website=True)
     def payment_method(self, **kwargs):
-        acquirers = list(request.env['payment.acquirer'].search([('website_published', '=', True), ('registration_view_template_id', '!=', False), ('payment_flow', '=', 's2s')]))
+        acquirers = list(request.env['payment.acquirer'].search([
+            ('website_published', '=', True), ('registration_view_template_id', '!=', False),
+            ('payment_flow', '=', 's2s'), ('company_id', '=', request.env.user.company_id.id)
+        ]))
         partner = request.env.user.partner_id
         payment_tokens = partner.payment_token_ids
         payment_tokens |= partner.commercial_partner_id.sudo().payment_token_ids
diff --git a/addons/payment/views/payment_portal_templates.xml b/addons/payment/views/payment_portal_templates.xml
index bac8783fcea..8328fac20c8 100644
--- a/addons/payment/views/payment_portal_templates.xml
+++ b/addons/payment/views/payment_portal_templates.xml
@@ -34,7 +34,7 @@
     <!-- TDE FIXME: was customize_show=True -->
     <template id="pay_meth_link" inherit_id="portal.portal_layout">
         <xpath expr="//div[hasclass('o_portal_my_details')]" position="inside">
-            <t t-if="request.env['payment.acquirer'].search([('website_published', '=', True), ('registration_view_template_id', '!=', False), ('payment_flow', '=', 's2s')])">
+            <t t-if="request.env['payment.acquirer'].search([('website_published', '=', True), ('registration_view_template_id', '!=', False), ('payment_flow', '=', 's2s'), ('company_id', '=', request.env.user.company_id.id)])">
                 <div class='manage_payment_method mt16'><a href="/my/payment_method">Manage your payment methods</a></div>
             </t>
         </xpath>