Daily updates from Odoo
Thursday, July 20, 2023
1 change
Security fixes and vulnerability patches
SEPA Direct Debit mandates now require a real payment to be matched before the mandate is validated. This reduces the risk of customers registering bank account details they do not control and makes mandate approval more trustworthy.
Original PR description
The current way to accept mandates (confirm transactions immediately) is not considered secure enough since the customer could input any account number (iban) without confirming that it's their account number. We introduce a new logic to confirm mandates, an effective payment must be made before the validation. When a bank statement matching the transaction data is encoded in the database, the transaction is confirmed (and the mandate as well, generating the corresponding token). task-3347338 See also: - odoo/odoo#126929 - odoo/upgrade#4944