Daily updates from Odoo
Wednesday, April 3, 2024
1 change
Security fixes and vulnerability patches
This fix strengthens privacy controls in the Calendar module by preventing uninvited administrators from viewing private event details. Only event organizers and attendees can now access private event information, ensuring confidential meetings remain protected. The update includes new safeguards to prevent unauthorized editing of any events by uninvited admins.
Original PR description
This commit reverts [#133504](https://github.com/odoo/odoo/pull/133504), as it was deliberating access to private event information to uninvited administrators in the calendar view. Only the event organizer and its attendees must be able to fetch private events information. In addition, two tests have been added to: 1. ensure the confidentiality of private events from uninvited administrators and 2. prohibit uninvited administrators from edit the information of any event, private or not. task-3837646 Forward-Port-Of: odoo/odoo#159743