[FIX] website_form: cancel records creation if error

When running an automated action on record creation, if the action
raises a UserError/ValidationError, the record will still be created.

To reproduce the error:
(Need website_crm,base_automation. Enable debug mode)
1. Create an Automated Action
    - Model: Lead/Opportunity
    - Trigger: On Creation & Update
    - Trigger Fields: Phone (crm.lead)
    - Action To Do: Execute Python Code
    - Python Code:
    ```python
    if record.phone:
        raise UserError("Lorem ipsum")
    ```
2. On website, add a website form WF
    - Action: "Create an Opportunity"
3. Complete and submit WF including a phone number

Error: An error message is displayed ("Lorem ispum"). However, the lead
has been created and is present in CRM Pipeline.

An on-creation automated action is executed once the record is executed,
but nothing will cancel this records creation if the action raises a
UserError/ValidationError.

OPW-2423948

closes odoo/odoo#69477

Signed-off-by: Raphael Collet (rco) <rco@openerp.com>

1 files changed, 7 insertions, 2 deletions

diff --git a/addons/website_form/controllers/main.py b/addons/website_form/controllers/main.py
index 3d3bdb87812..1d4daba4cff 100644
--- a/addons/website_form/controllers/main.py
+++ b/addons/website_form/controllers/main.py
@@ -36,8 +36,13 @@ class WebsiteForm(http.Controller):
             raise BadRequest('Session expired (invalid CSRF token)')
 
         try:
-            if request.env['ir.http']._verify_request_recaptcha_token('website_form'):
-                return self._handle_website_form(model_name, **kwargs)
+            # The except clause below should not let what has been done inside
+            # here be committed. It should not either roll back everything in
+            # this controller method. Instead, we use a savepoint to roll back
+            # what has been done inside the try clause.
+            with request.env.cr.savepoint():
+                if request.env['ir.http']._verify_request_recaptcha_token('website_form'):
+                    return self._handle_website_form(model_name, **kwargs)
             error = _("Suspicious activity detected by Google reCaptcha.")
         except (ValidationError, UserError) as e:
             error = e.args[0]