Daily updates from Odoo
Monday, September 12, 2022
1 change · master
Security fixes and vulnerability patches
This fix ensures customer follow-up financial fields are only available to users with the appropriate accounting permissions. It also tightens the underlying access checks and limits unnecessary data refreshes, reducing the risk of improper access while keeping follow-up information accurate.
Original PR description
All the fields on res.partner computed with _compute_for_followup should have account.group_account_readonly or account.group_account_invoice groups. _query_followup_level should check for account.move.line read rights and the flush should not be on all fields. This PR is a followup on https://github.com/odoo/enterprise/pull/26102 . opw-2811678