Daily updates from Odoo
Wednesday, August 30, 2023
1 change · master
Security fixes and vulnerability patches
Portal users no longer get direct access to subscription recurrence data. The subscription portal still shows the needed information, but it now uses controlled internal access where required, reducing unnecessary exposure of business data.
Original PR description
…oral.recurrence Before this commit, the sale.temporal.recurrence records had security rules for portal users. It was only needed to display the list of sale.order in the /my/subscription page. We decide to remove this portal access and to use sudo when necessary. The /my/subscription/<int:order_id> is using the sudoed record, therefore no change is needed in that view. taskid: 3221012