From ccf8ca3c04513e27c026688b7c1e0969a3b7d02c Mon Sep 17 00:00:00 2001
From: Valentin Chevalier <vcr@odoo.com>
Date: Thu, 28 Apr 2022 08:24:25 +0000
Subject: [PATCH] [FIX] payment: show capture&void buttons to the right users

Users without the right permission see the buttons but can't use them.

Capture and void buttons are now only visible and usable for admin or
users in account.group_account_invoice group (for invoicing module).

task-2785144

X-original-commit: db6b54cc49ba7d9266e766112017604ed98c2cb3
Part-of: odoo/odoo#91923
---
 addons/payment/views/account_invoice_views.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/addons/payment/views/account_invoice_views.xml b/addons/payment/views/account_invoice_views.xml
index f3ee42b535c..c6fb4ed6297 100644
--- a/addons/payment/views/account_invoice_views.xml
+++ b/addons/payment/views/account_invoice_views.xml
@@ -15,9 +15,11 @@
             <xpath expr="//button[@id='account_invoice_payment_btn']" position="after">
                 <field name="authorized_transaction_ids" invisible="1"/>
                 <button name="payment_action_capture" type="object"
+                        groups="account.group_account_invoice"
                         string="Capture Transaction" class="oe_highlight" data-hotkey="shift+g"
                         attrs="{'invisible': ['|', '|', ('move_type', 'not in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), ('state', '!=', 'posted'), ('authorized_transaction_ids', '=', [])]}"/>
                 <button name="payment_action_void" type="object"
+                        groups="account.group_account_invoice"
                         string="Void Transaction" data-hotkey="shift+v"
                         confirm="Are you sure you want to void the authorized transaction? This action can't be undone."
                         attrs="{'invisible': ['|', '|', ('move_type', 'not in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund')), ('state', '!=', 'posted'), ('authorized_transaction_ids', '=', [])]}"/>