[FIX] auth_signup: check user group in "signup_get_auth_param"

Task-2250264 closes odoo/odoo#56569 X-original-commit: 63d21db477e5b29c4c5173f18208348d6df617e0 Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
2020-08-26 09:38:47 +00:00
parent 922d81dc9c
commit f3baf3816f
1 changed files with 3 additions and 0 deletions
@@ -105,6 +105,9 @@ class ResPartner(models.Model):
        """ Get a signup token related to the partner if signup is enabled.
            If the partner already has a user, get the login parameter.
        """
+        if not self.env.user.has_group('base.group_user') and not self.env.is_admin():
+            raise exceptions.AccessDenied()
+
        res = defaultdict(dict)

        allow_signup = self.env['res.users']._get_signup_invitation_scope() == 'b2c'