diff options
Diffstat (limited to 'addons')
| -rw-r--r-- | addons/payment/controllers/portal.py | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/addons/payment/controllers/portal.py b/addons/payment/controllers/portal.py index 51a1ffd436e..eb102932de0 100644 --- a/addons/payment/controllers/portal.py +++ b/addons/payment/controllers/portal.py @@ -168,7 +168,13 @@ class WebsitePayment(http.Controller): if order_id: try: order_id = int(order_id) - order = env['sale.order'].browse(order_id) + if partner_id: + # `sudo` needed if the user is not connected. + # A public user woudn't be able to read the sale order. + # With `partner_id`, an access_token should be validated, preventing a data breach. + order = env['sale.order'].sudo().browse(order_id) + else: + order = env['sale.order'].browse(order_id) values.update({ 'currency': order.currency_id, 'amount': order.amount_total, |