[FIX] payment: prevent access error for manual payments

Rev. cf1df16aea5d23006184f51a20c18f5bf3dd6d8c introduced new callback
fields with restricted access. The lazy hash generation in create() was
however causing access errors for manual transactions created by users
who are not administrators (e.g. Accountants).

Those manual transactions do not typically need a callback, but checking
the presence of the callback requires a limited sudo() context.

Similarly, the execute_callback() method may be called for a manual,
non-admin transaction, and should not do anything if there is no
callback, instead of crashing with an AccessError.

The generation of the hash and execution of the callback should be done
with a normal environment, though, as these must only be used for
transactions run by the system.

opw-747536

0 files changed, 0 insertions, 0 deletions