From 925daad7f3cccd9f40beffefaf6203b759e2d7e0 Mon Sep 17 00:00:00 2001
From: std-odoo <std@odoo.com>
Date: Wed, 6 Sep 2023 08:00:04 +0200
Subject: [PATCH] [IMP] mail_plugin: do not allow portal user to use the addin

Purpose
=======
Show an error during the login process if a portal
user tries to use the Outlook / Gmail addin.

Task-3344536

closes odoo/odoo#134450

Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
---
 addons/mail_plugin/controllers/authenticate.py | 4 +++-
 addons/mail_plugin/views/mail_plugin_login.xml | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/addons/mail_plugin/controllers/authenticate.py b/addons/mail_plugin/controllers/authenticate.py
index 190ff2b720b..25bd30b73e4 100644
--- a/addons/mail_plugin/controllers/authenticate.py
+++ b/addons/mail_plugin/controllers/authenticate.py
@@ -9,7 +9,7 @@ import logging
 import odoo
 import werkzeug
 
-from odoo import http
+from odoo import _, http
 from odoo.http import request
 from werkzeug.exceptions import NotFound
 
@@ -27,6 +27,8 @@ class Authenticate(http.Controller):
          old route name "/mail_client_extension/auth is deprecated as of saas-14.3,it is not needed for newer
          versions of the mail plugin but necessary for supporting older versions
          """
+        if not request.env.user._is_internal():
+            return request.render('mail_plugin.app_error', {'error': _('Access Error: Only Internal Users can link their inboxes to this database.')})
         return request.render('mail_plugin.app_auth', values)
 
     @http.route(['/mail_client_extension/auth/confirm', '/mail_plugin/auth/confirm'], type='http', auth="user", methods=['POST'])
diff --git a/addons/mail_plugin/views/mail_plugin_login.xml b/addons/mail_plugin/views/mail_plugin_login.xml
index d19728234e4..b025e877f84 100644
--- a/addons/mail_plugin/views/mail_plugin_login.xml
+++ b/addons/mail_plugin/views/mail_plugin_login.xml
@@ -19,4 +19,9 @@
             </form>
         </t>
     </template>
+    <template id="mail_plugin.app_error" name="Accept app">
+        <t t-call="web.login_layout">
+            <div class="alert alert-danger" role="alert" t-out="error"/>
+        </t>
+    </template>
 </odoo>