[FIX] *: use `auth='public'` in controllers that use `request.env`

The following trick used to work, because `sudo()` was actually making
an environment for the superuser to operate upon:

request.env[...].sudo().method(...)

It no longer works in general, since `sudo()` now makes an environment
in superuser mode but with `uid=None`!  It may still work by accident
for operations that never use `env.uid`, but is broken in general.

Using `auth='public'` fixes the problem by using the public user when no
user is available.

closes odoo/odoo#34297

Signed-off-by: Olivier Dony (odo) <odo@openerp.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/addons/payment_alipay/controllers/main.py b/addons/payment_alipay/controllers/main.py
index 1f28217cabc..14fc05efca8 100644
--- a/addons/payment_alipay/controllers/main.py
+++ b/addons/payment_alipay/controllers/main.py
@@ -49,14 +49,14 @@ class AlipayController(http.Controller):
             return 'success'
         return ""
 
-    @http.route('/payment/alipay/return', type='http', auth="none", methods=['GET', 'POST'])
+    @http.route('/payment/alipay/return', type='http', auth="public", methods=['GET', 'POST'])
     def alipay_return(self, **post):
         """ Alipay return """
         _logger.info('Beginning Alipay form_feedback with post data %s', pprint.pformat(post))
         self._alipay_validate_data(**post)
         return werkzeug.utils.redirect('/payment/process')
 
-    @http.route('/payment/alipay/notify', type='http', auth='none', methods=['POST'], csrf=False)
+    @http.route('/payment/alipay/notify', type='http', auth='public', methods=['POST'], csrf=False)
     def alipay_notify(self, **post):
         """ Alipay Notify """
         _logger.info('Beginning Alipay notification form_feedback with post data %s', pprint.pformat(post))