Odoo Changelog — 2019-10-15

Tuesday, October 15, 2019

1 change

Security(1)

Security fixes and vulnerability patches

Forward Port of #6024 to master (failed)

EnterprisemasterdocumentsSECURITY

Users can no longer upload new documents into folders where they only have read access. This protects workspace permissions and prevents unauthorized content from being added by mistake or through a loophole.

Original PR description

[FIX] documents: prevents upload in limited workspaces

Before this commit, a user could still upload a new
document in a folder for which they only have a read access
as the AccessError was intercepted in the upload route.

This commit fixes this issue and makes so that the
route now uses the multi create.

Task: #2083596

Forward-Port-Of: odoo/enterprise#6024

#permissions#documents#upload#access-control