Daily updates from Odoo
Tuesday, August 22, 2023
1 change · master
Security fixes and vulnerability patches
Studio approval rules for business actions are now validated by the server instead of relying mainly on browser-side checks. This prevents users from bypassing required approvals through direct calls or alternate buttons, while preserving automated elevated flows such as eCommerce order confirmation.
Original PR description
Before, the approval mechanism validation was mostly implemented in the frontend: * The frontend detects that a button has a approval validation with `get_spec_approval` * Whenever the button is…
Before, the approval mechanism validation was mostly implemented in the frontend: * The frontend detects that a button has a approval validation with `get_spec_approval` * Whenever the button is pressed, the frontend contacted the server to know if the user can indeed call the method (with `check_approval`) * If the server answered positively then the frontend did the call to the server to execute the method The problem is that a tech-savy user could bypass this approval check: * by manually calling the method on the model * by calling a button doing the same thing outside a form view Now, for method approval (in contrast to action approval) we do it in the backend: * The frontend detects that a button has a approval validation with `get_spec_approval` * The frontend does not need to know if it is approved or not, it directly call the method on the model * When receiving the call, the backend will now check if it is approved before executing it Technically, this PR is inspired by `base.automation`. When an approval rule is created/written then the corresponding method is patched to verify approval rules. task-id:3285734