Daily updates from Odoo
Tuesday, November 14, 2023
1 change · master
Security fixes and vulnerability patches
This change prevents users with only interviewer rights from seeing or opening referred applicants in the Recruitment app unless they are assigned as the applicant interviewer or job position interviewer. Users can still view their referrals in the Referrals app, while direct URL access in Recruitment is now blocked when unauthorized.
Original PR description
Steps to reproduce: - Have a user that have the interviewer rights but not higher ones - Set the user as the referrer of an applicant but not as the interviewer and not as the job position…
Steps to reproduce: - Have a user that have the interviewer rights but not higher ones - Set the user as the referrer of an applicant but not as the interviewer and not as the job position interviewer - As this user go to the recruitment app - You can see the applicant and you can open it Expected behavior: in that situation the user should not be able to see the applicant or access it in any way in the recruitment app. Explanation: The user was able to see the applicant because the my referral view is based on the hr.applicant model and thus the user has access to the record in both apps. But the problem should be fixed in the recruitment app because the user should still be able to see the applicant in the referral app. after this fix: You'll not be able to see the applicant in the recruitment app if you are not the interviewer of the applicant or the interviewer of the job position if you only have the interviewer rights. You'll also get an access error if you try to access the applicant directly by URL. task-3457405