The route used by the sale portal to update an option qty didn't check that
the modified SOline was effectively an option.
On the portal, only the optional lines were editable through the interface,
but through xmlrpc, a portal user could be able to remove/update the qty
of non optional lines from a quotation.
This is not a true security failure since only the quantity could be modified
through this route, but it makes sense to add a check to ensure this kind
of modification cannot happen.
closesodoo/odoo#88366
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
Victor Feyens
38e02bcb7f