Odoo Changelog — 2023-09-23

Saturday, September 23, 2023

1 change

Security(1)

Security fixes and vulnerability patches

[FIX] sale_subscription: verify and reroute payment flows

Enterprisemastersale_subscriptionaccount_avatax_sale_subscriptionwebsite_sale_account_taxcloudSECURITY

Subscription-related payment flows now take transaction details directly from the linked business document instead of accepting them from the payment page request. This reduces the risk of incorrect or unexpected payment data and makes payment handling for sales orders, invoices, and subscriptions more reliable.

Original PR description

This commit changes the way transactions linked to a document (sales
order, invoice...) are created in a payment flow. Rather than receiving
and trusting the transaction values from the controller, they are now
read from the linked document, and the payment flow is rerouted to use
the document's module's controllers instead of that of `payment`.

This ensures that no unexpected value can be passed to the `create`
method of a transaction, and simplifies the implementation of the
payment flows of linked documents.

task-3136240

See also:
- https://github.com/odoo/odoo/pull/126425
- https://github.com/odoo/upgrade/pull/5124

#payments#subscriptions#transactions#portal