Daily updates from Odoo
Thursday, January 31, 2019
2 changes
Security fixes and vulnerability patches
Server actions now verify that the user has permission to read the related model before the action runs. This helps prevent unauthorized remote access to data or operations, strengthening access control for business processes.
Original PR description
Description of the issue/feature this PR addresses: To prevent an unallowed rpc access. Check the access of read of the linked model of the server action. @odony -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
This change closes gaps that could let unauthorized users retrieve system metadata such as external identifiers or default record information. It strengthens access checks in the core data model so sensitive internal information is only available to permitted users.
Original PR description
Description of the issue/feature this PR addresses: get_external_id is not really protected. Today the id is an integer and when you try to call by xml_rpc you have this error : TypeError: dictionary key must be string. But if one day, xml_rpc allow interger in key, or the id is an a string, anyone can download external id. get_metadata is only protected by the check rules read of res.users. default_get is not protected @odony -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr