Daily updates from Odoo
Tuesday, September 19, 2023
1 change
Security fixes and vulnerability patches
Email links used to sign documents now include an expiration check, reducing the risk if an email is forwarded or an inbox is compromised. If a signing link has expired or is missing the required security details, the signer can request a fresh link by email.
Original PR description
Currently when you receive a link for signing a document in your email, this link is valid forever. So if your inbox was leaked or the email was forwarded, the link would still be valid. In order to improve the security of sign, it was decided to add an expiry date to the link. This commit implements this feature by adding an encrypted string and a timestamp to the signature URL. The string is the result of the encryption of the timestamp and the sign request item id with the server secret being used as key. When trying to sign, we can decrypt this string and check that it is valid and that the signing date is before the expiry timestamp. If the link is expired or the params were not present in the URL, we allow the user to receive a new link in his email. task-3234539