Odoo Changelog — 2023-10-25

Wednesday, October 25, 2023

2 changes · master

Security(1)

Security fixes and vulnerability patches

[IMP] website: add signature to form

CoremasterwebsiteSecurity

Website forms now include a signature so Odoo can confirm that submitted forms were generated by the website itself. This helps prevent people from sending unexpected or unauthorized form fields to the website form handler, improving data integrity and security for website submissions.

Original PR description

This commits add a signature to the website_form.

The purpose of this modification is to allow the controllers to be able to verify that the form was originally generated from the view.

This prevent the end user to submit arbitrary values to the website_form controller.

In this commit, email_cc and email_bcc are treated as the same fied as it holds the same function

This does not offer protection against submission replay. Previous versions of the form are not invalidated by editing the view.

If one need to completely reset that protection and invalidate the previously generated website_form, the only solution is currently to change the database secret.

#website forms#form validation#security

New Features(1)

New functionality added to Odoo

[ADD] auth_signup: New connection to user mail alert

PR #115362

Coremasterauth_signupauth_totpbaseSecurity

Users can now receive an email when a new device signs in to their account, helping them spot unexpected access sooner. Alerts are adjusted for two-factor authentication and trusted devices to avoid unnecessary notifications in common safe cases.

Original PR description

Description of the issue/feature this PR addresses:

No way to know if someone logs into your account.

Current behavior before PR:

Prior to this, there was no way of knowing when a new device logged
into your personal account.

Desired behavior after PR is merged:

Adding the new version of the authenticate function, user's will now automaticly
receive a mail containing informations on a new connection made to their account.
This system uses a mail template sent automaticly on a new connection if the user
did not activate 2FA or if his device is not in the trusted devices of his
account except if his 2FA method is mail where no mail will be sent even if
his device is not trusted.

task-3191567

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

This commits add a signature to the website_form. The purpose of this modification is to allow the controllers to be able to verify that the form was originally generated from the view. This prevent the end user to submit arbitrary values to the website_form controller. In this commit, email_cc and email_bcc are treated as the same fied as it holds the same function This does not offer protection against submission replay. Previous versions of the form are not invalidated by editing the view. If one need to completely reset that protection and invalidate the previously generated website_form, the only solution is currently to change the database secret.

Description of the issue/feature this PR addresses: No way to know if someone logs into your account. Current behavior before PR: Prior to this, there was no way of knowing when a new device logged into your personal account. Desired behavior after PR is merged: Adding the new version of the authenticate function, user's will now automaticly receive a mail containing informations on a new connection made to their account. This system uses a mail template sent automaticly on a new connection if the user did not activate 2FA or if his device is not in the trusted devices of his account except if his 2FA method is mail where no mail will be sent even if his device is not trusted. task-3191567 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr