[FIX] website_crm_score: don't display new opp for ungraded partner.

Button to create new opp are reserved to graded partner.
Employees will use backend crm, and classis portal user cannot create lead for them.

+ fix 403 when create an opp because no access on crm activities.

This opw fixes #21222

3 files changed, 8 insertions, 7 deletions

diff --git a/addons/website_crm_partner_assign/controllers/main.py b/addons/website_crm_partner_assign/controllers/main.py
index 9166b37fa31..ced982eed4a 100644
--- a/addons/website_crm_partner_assign/controllers/main.py
+++ b/addons/website_crm_partner_assign/controllers/main.py
@@ -169,7 +169,7 @@ class WebsiteAccount(CustomerPortal):
         return request.render(
             "website_crm_partner_assign.portal_my_opportunity", {
                 'opportunity': opp,
-                'user_activity': opp.activity_ids.filtered(lambda activity: activity.user_id == request.env.user)[:1],
+                'user_activity': opp.sudo().activity_ids.filtered(lambda activity: activity.user_id == request.env.user)[:1],
                 'stages': request.env['crm.stage'].search([('probability', '!=', '100')], order='sequence desc'),
                 'activity_types': request.env['mail.activity.type'].sudo().search([]),
                 'states': request.env['res.country.state'].sudo().search([]),
diff --git a/addons/website_crm_partner_assign/models/crm_lead.py b/addons/website_crm_partner_assign/models/crm_lead.py
index ce914a5fc4d..4115e397f64 100644
--- a/addons/website_crm_partner_assign/models/crm_lead.py
+++ b/addons/website_crm_partner_assign/models/crm_lead.py
@@ -3,9 +3,9 @@
 
 import random
 
-from odoo.addons.base_geolocalize.models.res_partner import geo_find, geo_query_address
 from odoo import api, fields, models, _
-
+from odoo.addons.base_geolocalize.models.res_partner import geo_find, geo_query_address
+from odoo.exceptions import AccessDenied
 
 class CrmLead(models.Model):
     _inherit = "crm.lead"
@@ -254,9 +254,10 @@ class CrmLead(models.Model):
 
     @api.model
     def create_opp_portal(self, values):
-        if self.env.user.partner_id.grade_id or self.env.user.commercial_partner_id.grade_id:
-            user = self.env.user
-            self = self.sudo()
+        if not (self.env.user.partner_id.grade_id or self.env.user.commercial_partner_id.grade_id):
+            raise AccessDenied()
+        user = self.env.user
+        self = self.sudo()
         if not (values['contact_name'] and values['description'] and values['title']):
             return {
                 'errors': _('All fields are required !')
diff --git a/addons/website_crm_partner_assign/views/website_crm_partner_assign_templates.xml b/addons/website_crm_partner_assign/views/website_crm_partner_assign_templates.xml
index b191878e62d..96346a3814d 100644
--- a/addons/website_crm_partner_assign/views/website_crm_partner_assign_templates.xml
+++ b/addons/website_crm_partner_assign/views/website_crm_partner_assign_templates.xml
@@ -272,7 +272,7 @@
             <h3>
                 My Opportunities
                 <t t-call="portal.portal_searchbar"/>
-                <button name='new_opp' data-toggle="modal" data-target=".modal_new_opp" class="btn btn-default pull-right mr8"><i class="fa fa-plus fa-lg" /></button>
+                <button t-if="request.env.user.partner_id.grade_id or request.env.user.commercial_partner_id.grade_id" name='new_opp' data-toggle="modal" data-target=".modal_new_opp" class="btn btn-default pull-right mr8"><i class="fa fa-plus fa-lg" /></button>
             </h3>
             <div class="modal fade modal_new_opp" role="form" aria-hidden="true">
                 <div class="modal-dialog">