Wednesday, March 6, 2024
1 change · master
Security fixes and vulnerability patches
Odoo now stores session information in JSON instead of a less safe format. This reduces the risk of session data being abused to run unwanted code, improving overall platform security.
Original PR description
Remove the use of `pickle` for managing information contained in the session. The purpose is to improve security since `pickle` is considered unsafe (for example by exploiting the fact of executing code during unpickling). It is therefore recommended to use the JSON format which is generally safer to store sessions.