Daily updates from Odoo
Tuesday, May 26, 2020
1 change · master
Security fixes and vulnerability patches
Sensitive values such as passwords, tokens, PINs, and SMS verification tokens are now stored using a dedicated secret field across several Odoo apps. This reduces the risk of unauthorized viewing by making these values visible only to superusers while remaining usable for configuration and integrations.
Original PR description
Community branch: https://github.com/odoo/odoo/pull/47103 Passwords, tokens, pins and other secret values have always been stored in Char fields with limited accesses usually restricted to the superuser. Such values are sensitive yet there was no standard easy way to prevent unauthorized access. We introduce a new Secret field type behaving just like the standard Char field it inherits from. The notable difference is that the secret field value is empty to all users except the super user. On other words, for regular users, it behaves like a write-only field.