Odoo Changelog — 2024-03-22

Friday, March 22, 2024

2 changes

Security(2)

Security fixes and vulnerability patches

[FW][FIX] delivery_ups_rest: restrict access to some fields

Enterprise17.0delivery_ups_restSECURITY

This update fixes a security issue where UPS shipping credentials were accessible to non-admin users in the new UPS REST module. The fix restricts access to sensitive credential fields and ensures proper authorization checks are in place, preventing unauthorized users from viewing or modifying shipping configuration details.

Original PR description

Steps to reproduce:
- Install both ups_rest and ups legacy
- Configure the new ups shipping method as admin
- Create an SO and try to add ups delivery as demo
- Access error

Bug:
in ups legacy credential fields are only accessible to the admin sudo is used on the request
on the new app they aren't hidden so no sudo was added on the request

Fix:
it makes sense for me to keep the credentials hidden for the new module and use sudo on the request

opw-3771840

Forward-Port-Of: odoo/enterprise#58895

#security#access-control#credentials#shipping

[FW][15.0][FIX] hr_expense: Apply rule to account moves to prevent Expense Team Approver user can access to all moves

PR #158323

Core17.0hr_expenseaccountSECURITY

This fix prevents Expense Team Approver users from viewing all company invoices and bills. Previously, these users could access unrelated customer invoices and vendor bills through the portal. Now they can only see invoices that are directly linked to expense reports, improving data security and privacy.

Original PR description

Related to https://github.com/odoo/odoo/commit/b6fc5ef468f47c109b2d007f211e02ca5f3fe093

Apply rule to account moves to prevent Expense Team Approver user can access to all moves

**Description of the issue/feature this PR addresses**:
User with Expenses: Team Approver group should not see all moves.

**Example use case**:
- Create a user with Expenses: Team Approver group.
- Login with the created user to /my
- The user will only see invoices linked to expenses.

**Current behavior before PR**:
User with Expenses: Team Approver group will **only** be able to see invoices linked to expenses.

Ping @pedrobaeza 

@Tecnativa TT48242

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#156858

#access control#data security#expense management#user permissions

Steps to reproduce: - Install both ups_rest and ups legacy - Configure the new ups shipping method as admin - Create an SO and try to add ups delivery as demo - Access error Bug: in ups legacy credential fields are only accessible to the admin sudo is used on the request on the new app they aren't hidden so no sudo was added on the request Fix: it makes sense for me to keep the credentials hidden for the new module and use sudo on the request opw-3771840 Forward-Port-Of: odoo/enterprise#58895

Related to https://github.com/odoo/odoo/commit/b6fc5ef468f47c109b2d007f211e02ca5f3fe093 Apply rule to account moves to prevent Expense Team Approver user can access to all moves **Description of the issue/feature this PR addresses**: User with Expenses: Team Approver group should not see all moves. **Example use case**: - Create a user with Expenses: Team Approver group. - Login with the created user to /my - The user will only see invoices linked to expenses. **Current behavior before PR**: User with Expenses: Team Approver group will **only** be able to see invoices linked to expenses. Ping @pedrobaeza @Tecnativa TT48242 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#156858