Daily updates from Odoo
Friday, July 7, 2023
1 change
Security fixes and vulnerability patches
VoIP SIP passwords are now protected with clearer access rules. Only administrators and the account owner can view this sensitive field, reducing the chance of inappropriate access while preserving needed self-service access.
Original PR description
Remove `sip_password` from `USER_PRIVATE_FIELDS` and restrict it to `base.group_erp_manager` instead. Since the field is already in `SELF_READABLE_FIELDS` as well, only admins and the user to whom the record belongs can read the field.