From be4e1d140088787675ca8975faeca046abed646c Mon Sep 17 00:00:00 2001 From: qdp-odoo Date: Fri, 5 May 2023 14:40:39 +0000 Subject: [PATCH] [IMP] account: do not trust bank accounts at their creation This comes as a followup of https://github.com/odoo/odoo/pull/120423 where we restrict unallowed users to toggle the field allow_out_payment when writing on res.partner.bank. Similarly, we'll now do the same check at the creation of bank accounts closes odoo/odoo#120694 Signed-off-by: Brice Bartoletti (bib) --- addons/account/models/res_partner_bank.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/addons/account/models/res_partner_bank.py b/addons/account/models/res_partner_bank.py index 40786305541..e20b9d1dccf 100644 --- a/addons/account/models/res_partner_bank.py +++ b/addons/account/models/res_partner_bank.py @@ -249,6 +249,12 @@ class ResPartnerBank(models.Model): @api.model_create_multi def create(self, vals_list): # EXTENDS base res.partner.bank + + if not self.user_has_groups('account.group_validate_bank_account'): + for vals in vals_list: + # force the allow_out_payment field to False in order to prevent scam payments on newly created bank accounts + vals['allow_out_payment'] = False + res = super().create(vals_list) for account in res: msg = escape(_("Bank Account %s created")) % account._get_html_link(title=f"#{account.id}")