[FIX] payment: don't show unwanted payment token

The access right on payment_token is based on the partner_id
linked with the user

If there is token link with the public user,
they are shown for every request were the partner_id is not defined
If you are logged with an internal user with sales access right,
you'll see all the payment_token linked with the acquirer

We should avoid both situation and show only the payment_token
from the legit partner_id
the one of the current user or the one given as parameter

closes odoo/odoo#44346

X-original-commit: 9edad5d9018ae357e955a5e21e9366e56caa8e31
Signed-off-by: Damien Bouvy (dbo) <dbo@odoo.com>
Co-authored-by: Damien Bouvy <dbo@odoo.com>

addons/payment/controllers/portal.py

@@ -222,7 +222,14 @@ class WebsitePayment(http.Controller):
         # s2s mode will always generate a token, which we don't want for public users
         valid_flows = ['form', 's2s'] if not user._is_public() else ['form']
         values['acquirers'] = [acq for acq in acquirers if acq.payment_flow in valid_flows]
-        values['pms'] = request.env['payment.token'].search([('acquirer_id', 'in', acquirers.ids)])
+        if partner_id:
+            values['pms'] = request.env['payment.token'].search([
+                ('acquirer_id', 'in', acquirers.ids),
+                ('partner_id', '=', partner_id)
+            ])
+        else:
+            values['pms'] = []
+
 
         return request.render('payment.pay', values)