Daily updates from Odoo
Monday, April 8, 2019
1 change · master
Security fixes and vulnerability patches
This fix prevents internal sales users from gaining contact creation rights through the CRM module when those rights were explicitly disabled. It helps keep user permissions aligned with company access policies and avoids unintended contact creation.
Original PR description
Step to reproduce Install module Sale and Contact - Create an internal user U with right in Sale: "User: Own Documents Only" and Contact creation not checked - Install module CRM - Log as user U and go to Contact module Bug: The user U has the rights to create a contact opw:1962359