diff options
| author | root <yenthevg@gmail.com> | 2020-06-23 10:06:18 +0000 |
|---|---|---|
| committer | root <yenthevg@gmail.com> | 2020-07-23 15:41:13 +0000 |
| commit | 98b0f01fc57470ce1a9e2a12fd9173b3b131cbcc (patch) | |
| tree | c41273e42573fc8bd38970a9c7d12c417ab116d9 /addons/payment | |
| parent | 07bafcb79214e1f1edbb70e509a0df3c866bb208 (diff) | |
[FIX] payment: mask payment method keys in onboarding dialog
Before this commit the tokens from payment providers (PayPal, Stripe) are shown in plain text in the onboarding wizard.
This means that anyone with accounting rights can grab & copy tokens for PayPal & Stripe.
After this commit they're shielded off with a password=True option so they're not directly readable and copyable.
Steps to reproduce: Open an Odoo instance, go to Accounting > Invoices and click on the 'Set Payments' option for the onboarding wizard.
Next choose Paypal or Credit card in the dialog and see how tokens are shown in plain-text.
closes odoo/odoo#54861
X-original-commit: 65e201ecee3bc145c2ae76d59b6d2fd31c737872
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
Diffstat (limited to 'addons/payment')
| -rw-r--r-- | addons/payment/views/payment_acquirer_onboarding_templates.xml | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/addons/payment/views/payment_acquirer_onboarding_templates.xml b/addons/payment/views/payment_acquirer_onboarding_templates.xml index a9d201a585f..c2e68bb19d4 100644 --- a/addons/payment/views/payment_acquirer_onboarding_templates.xml +++ b/addons/payment/views/payment_acquirer_onboarding_templates.xml @@ -39,7 +39,7 @@ <field name="paypal_user_type" widget="radio" nolabel="1"/> <field name="paypal_email_account" attrs="{'required': [('payment_method', '=', 'paypal')]}" string="Email"/> <field name="paypal_seller_account" attrs="{'invisible': [('paypal_user_type', '=', 'new_user')], 'required': [('paypal_user_type', '!=', 'new_user'), ('payment_method', '=', 'paypal')]}" /> - <field name="paypal_pdt_token" attrs="{'invisible': [('paypal_user_type', '=', 'new_user')], 'required': [('paypal_user_type', '!=', 'new_user'), ('payment_method', '=', 'paypal')]}" /> + <field name="paypal_pdt_token" password="True" attrs="{'invisible': [('paypal_user_type', '=', 'new_user')], 'required': [('paypal_user_type', '!=', 'new_user'), ('payment_method', '=', 'paypal')]}" /> </group> <p attrs="{'invisible': [('paypal_user_type', '!=', 'new_user')]}"> <span>Start selling directly without an account; an email will be sent by Paypal to create your new account and collect your payments.</span> @@ -52,9 +52,9 @@ </div> <div attrs="{'invisible': [('payment_method', '!=', 'stripe')]}"> <group> - <field name="stripe_secret_key" + <field name="stripe_secret_key" password="True" attrs="{'required': [('payment_method', '=', 'stripe')]}" /> - <field name="stripe_publishable_key" + <field name="stripe_publishable_key" password="True" attrs="{'required': [('payment_method', '=', 'stripe')]}" /> </group> <p> |