From c70de411a5e3bc0bc461ced806c888dc779d29fb Mon Sep 17 00:00:00 2001 From: Thibault Francois Date: Thu, 30 Jan 2020 14:17:13 +0000 Subject: [PATCH] [FIX] payment: don't show unwanted payment token The access right on payment_token is based on the partner_id linked with the user If there is token link with the public user, they are shown for every request were the partner_id is not defined If you are logged with an internal user with sales access right, you'll see all the payment_token linked with the acquirer We should avoid both situation and show only the payment_token from the legit partner_id the one of the current user or the one given as parameter closes odoo/odoo#44346 X-original-commit: 9edad5d9018ae357e955a5e21e9366e56caa8e31 Signed-off-by: Damien Bouvy (dbo) Co-authored-by: Damien Bouvy --- addons/payment/controllers/portal.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/addons/payment/controllers/portal.py b/addons/payment/controllers/portal.py index afe2a089bc4..2fc980147f1 100644 --- a/addons/payment/controllers/portal.py +++ b/addons/payment/controllers/portal.py @@ -222,7 +222,14 @@ class WebsitePayment(http.Controller): # s2s mode will always generate a token, which we don't want for public users valid_flows = ['form', 's2s'] if not user._is_public() else ['form'] values['acquirers'] = [acq for acq in acquirers if acq.payment_flow in valid_flows] - values['pms'] = request.env['payment.token'].search([('acquirer_id', 'in', acquirers.ids)]) + if partner_id: + values['pms'] = request.env['payment.token'].search([ + ('acquirer_id', 'in', acquirers.ids), + ('partner_id', '=', partner_id) + ]) + else: + values['pms'] = [] + return request.render('payment.pay', values)