[IMP] account: do not trust bank accounts at their creation

This comes as a followup of https://github.com/odoo/odoo/pull/120423 where we restrict unallowed users to toggle the field allow_out_payment when writing on res.partner.bank. Similarly, we'll now do the same check at the creation of bank accounts

closes odoo/odoo#120694

Signed-off-by: Brice Bartoletti (bib) <bib@odoo.com>

addons/account/models/res_partner_bank.py

@@ -249,6 +249,12 @@ class ResPartnerBank(models.Model):
     @api.model_create_multi
     def create(self, vals_list):
         # EXTENDS base res.partner.bank
+
+        if not self.user_has_groups('account.group_validate_bank_account'):
+            for vals in vals_list:
+                # force the allow_out_payment field to False in order to prevent scam payments on newly created bank accounts
+                vals['allow_out_payment'] = False
+
         res = super().create(vals_list)
         for account in res:
             msg = escape(_("Bank Account %s created")) % account._get_html_link(title=f"#{account.id}")