Monday, November 16, 2020
1 change · master
Security fixes and vulnerability patches
Odoo now has a standard way to store sensitive values such as passwords, API tokens, and PINs so they remain hidden from regular users while still allowing updates when needed. This improves protection for payment, email, LDAP, and point-of-sale credentials, and also prevents costly grouping or sorting on fields that can slow down the system.
Original PR description
Passwords, tokens, pins and other secret values have always been stored in Char fields with limited accesses usually restricted to the superuser. Such values are sensitive yet there was no standard easy way to prevent unauthorized access. We introduce a new `Secret` field type behaving just like the standard `Char` field it inherits from. The notable difference is that the secret field value is empty to all users except the super user. On other words, for regular users, it behaves like a write-only field. -- There are some fields that are quite expensive to group by or to order by, such field include relational fields (Many2many and One2many) and binary fields (both large blob of data and filesystem-stored attachments). In order to prevent non-efficient operations on those fields, we introduce a new `groupby` field attribute. This attribute is a boolean value controlling whether the field can be grouped by or ordered by.