[FIX] account: Check Move Status Before Posting

Beforehand, if two users independently opened a draft
invoice on their respective sessions, then both of them
clicked on the "Post" button, then the invoice was
posted twice.
On a more general aspect, the view currently "prevents" users
from posting moves several times, but technically speaking,
nothing stops users from posting moves several times.

Now, after checking that the user indeed has the right to post
a move, the next check is about verifying that the move is
not already posted.

opw-2479201

closes odoo/odoo#68837

X-original-commit: 71b82693bb6d62c659483d533be8d25905f3492f
Related: odoo/enterprise#17511
Signed-off-by: oco-odoo <oco-odoo@users.noreply.github.com>
Signed-off-by: Julien CHEVREAU <Julien-CHEVREAU@users.noreply.github.com>

4 files changed, 14 insertions, 3 deletions

diff --git a/addons/account/i18n/account.pot b/addons/account/i18n/account.pot
index cea615b8b5a..521986c0a3f 100644
--- a/addons/account/i18n/account.pot
+++ b/addons/account/i18n/account.pot
@@ -13804,6 +13804,12 @@ msgstr ""
 #. module: account
 #: code:addons/account/models/account_move.py:0
 #, python-format
+msgid "The entry %s (id %s) is already posted."
+msgstr ""
+
+#. module: account
+#: code:addons/account/models/account_move.py:0
+#, python-format
 msgid "You need to add a line before posting."
 msgstr ""
 
diff --git a/addons/account/models/account_bank_statement.py b/addons/account/models/account_bank_statement.py
index b345d02d605..8b27e6941ff 100644
--- a/addons/account/models/account_bank_statement.py
+++ b/addons/account/models/account_bank_statement.py
@@ -406,7 +406,9 @@ class AccountBankStatement(models.Model):
                 statement._set_next_sequence()
 
         self.write({'state': 'posted'})
-        self.line_ids.move_id._post(soft=False)
+        lines_of_moves_to_post = self.line_ids.filtered(lambda line: line.move_id.state != 'posted')
+        if lines_of_moves_to_post:
+            lines_of_moves_to_post.move_id._post(soft=False)
 
     def button_validate(self):
         if any(statement.state != 'posted' or not statement.all_lines_reconciled for statement in self):
diff --git a/addons/account/models/account_move.py b/addons/account/models/account_move.py
index b4d32f3371b..f44cfcc7140 100644
--- a/addons/account/models/account_move.py
+++ b/addons/account/models/account_move.py
@@ -2428,6 +2428,8 @@ class AccountMove(models.Model):
         if not self.env.su and not self.env.user.has_group('account.group_account_invoice'):
             raise AccessError(_("You don't have the access rights to post an invoice."))
         for move in to_post:
+            if move.state == 'posted':
+                raise UserError(_('The entry %s (id %s) is already posted.') % (move.name, move.id))
             if not move.line_ids.filtered(lambda line: not line.display_type):
                 raise UserError(_('You need to add a line before posting.'))
             if move.auto_post and move.date > fields.Date.context_today(self):
diff --git a/addons/account/tests/test_account_move_entry.py b/addons/account/tests/test_account_move_entry.py
index 0251391c443..b97a968481f 100644
--- a/addons/account/tests/test_account_move_entry.py
+++ b/addons/account/tests/test_account_move_entry.py
@@ -511,8 +511,9 @@ class TestAccountMove(AccountTestInvoicingCommon):
         next.action_post()
         self.assertEqual(next.name, '00000876-G 0002/2021')  # Wait, I didn't want this!
 
-        next.journal_id.sequence_override_regex = r'^(?P<seq>\d*)(?P<suffix1>.*?)(?P<year>(\d{4})?)(?P<suffix2>)$'
-        next.name = '/'
+        next.button_draft()
+        next.name = False
+        next.journal_id.sequence_override_regex = r'^(?P<seq>\d*)(?P<suffix1>.*?)(?P<year>(\d{4})?)(?P<suffix2>)$'        
         next.action_post()
         self.assertEqual(next.name, '00000877-G 0002/2020')  # Pfew, better!
         next = self.test_move.copy({'date': self.test_move.date})