Daily updates from Odoo
Friday, March 29, 2024
1 change
Security fixes and vulnerability patches
Fixed a security issue where users could see folder names from other companies they don't have access to. Now, when viewing folder hierarchies, any folders the user cannot access will display as "Restricted Folder" instead of showing their actual names. This prevents unauthorized information disclosure while maintaining the ability to navigate the complete folder structure.
Original PR description
Steps to reproduce: - Install `documents` module - Ensure you have access to 2 companies (Co. 1 and Co. 2) - Enable both companies - Create a Folder A in Co. 1 - Create a Folder B in Co. 2 with Folder A as parent - Create a Folder C in Co. 1 with Folder B as parent - Put a file in each folder - Enable only Co. 1 - On left panel, select Folder A and unfold until Folder C appears Issue: The folder B is visible. Cause: When retrieving the folders to display in the search_panel, we retrieve all the ancestors of the available folders to display the complete folder tree for all available folders. Solution: Change the name of the unauthorized folders to "Restricted Folder". opw-3701633 Forward-Port-Of: odoo/enterprise#59551 Forward-Port-Of: odoo/enterprise#58422