From f3baf3816f9af4dd490ea8b4891efeaa464a3572 Mon Sep 17 00:00:00 2001
From: std-odoo <std@odoo.com>
Date: Tue, 2 Jun 2020 05:16:53 +0000
Subject: [PATCH] [FIX] auth_signup: check user group in
 "signup_get_auth_param"

Task-2250264

closes odoo/odoo#56569

X-original-commit: 63d21db477e5b29c4c5173f18208348d6df617e0
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
---
 addons/auth_signup/models/res_partner.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/addons/auth_signup/models/res_partner.py b/addons/auth_signup/models/res_partner.py
index fe68ae5380d..edd7ce10203 100644
--- a/addons/auth_signup/models/res_partner.py
+++ b/addons/auth_signup/models/res_partner.py
@@ -105,6 +105,9 @@ class ResPartner(models.Model):
         """ Get a signup token related to the partner if signup is enabled.
             If the partner already has a user, get the login parameter.
         """
+        if not self.env.user.has_group('base.group_user') and not self.env.is_admin():
+            raise exceptions.AccessDenied()
+
         res = defaultdict(dict)
 
         allow_signup = self.env['res.users']._get_signup_invitation_scope() == 'b2c'