Daily updates from Odoo
Tuesday, November 19, 2019
3 changes
Security fixes and vulnerability patches
Rating records are now limited to internal employees, while public and portal users can still use approved rating flows through controlled website and project pages. This reduces the risk of unauthorized access to rating data without disrupting customer-facing feedback features.
Original PR description
Before, rating model was accessible (read, write, create) by everyone without any restriction (expect unlink). We change the ACLs of rating.rating to be accessible only by employees, but some are public, then we add some sudo call for previous functional flow. Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Customer rating records are now restricted to employees by default, reducing unnecessary access while keeping public rating flows working where needed. Helpdesk and subscription rating processes were adjusted so customers can still submit or view ratings through intended public links.
Original PR description
Before, rating model was accessible (read, write, create) by everyone without any restriction (expect unlink). We change the ACLs of rating.rating to be accessible only by employees, but some are public, then we add some sudo call for previous functional flow.
Enhancements to existing features
Message tracking now links tracked changes to the original field definition instead of relying on field names alone. This reduces the risk of exposing outdated or incorrect information when fields are renamed or removed, improving privacy and data consistency.
Original PR description
Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: -- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr