Tuesday, February 21, 2023
2 changes · master
Security fixes and vulnerability patches
Product pricing calculations are now clearer and more consistent across sales, website sales, expenses, memberships, and accounting. The update also limits access to an internal pricing method to reduce the risk of exposing sensitive cost information.
Original PR description
--- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Resolved issues and error corrections
This fix prevents private calendar events marked as free from being shown when another user views everybody's calendars. Public free events remain visible and are clearly labeled as free, helping users understand availability without exposing private details.
Original PR description
Steps to reproduce: - in the calendar, create 4 events with these configurations: (1) public + busy (2) public + free (3) private + busy (4) private + free - with an other user, go to calendar - active the filter "Everybody's calendars" Issue: Private events that are free are displayed on the calendar. Solution: To avoid displaying private elements that are free (of which we are not the user), we can override the `search_read` method to complete the domain. Indeed, these events have no reason to be placed in the cache. Moreover, public events that are free should still be displayed. Adding '(free)' in the name informs that the range is still free. opw-3047999