Daily updates from Odoo
Thursday, March 21, 2024
1 change · 17.0
Security fixes and vulnerability patches
This update fixes a security issue in the messaging system where data sent to users could be manipulated through the write method. The system now retrieves the actual stored data from the database instead of using potentially altered input values, ensuring users always see accurate information and preventing unauthorized data modifications.
Original PR description
When writing in a discuss channel, the updated value sent to the client should be read from the database, not directly from the values passed to the write method, which could lead into security issues. Partially backport of https://github.com/odoo/odoo/pull/139563 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr