Daily updates from Odoo
Monday, April 22, 2024
1 change · 17.0
Security fixes and vulnerability patches
Fixed a security issue where users could view Direct Debit Mandates from companies they don't have access to. The system now properly restricts mandate visibility based on company permissions, ensuring users only see mandates from their authorized companies.
Original PR description
Steps to reproduce: - Install account_sepa_direct_debit - Create another company - Go to "Invoicing / Configuration / Accounting / Journals" - Configure a journal (e.g. Bank) by adding an IBAN bank account number - Go to "Invoicing / Customers / Direct Debit Mandates" - Create a Direct Debit Mandate (DD Mandate): * Customer: [any customer with an IBAN bank account] (e.g. Gemini Furniture) * IBAN: [IBAN bank account of customer] * Journal: Bank * Start Date: [any] * Company: [the current company] - Save and validate the DD mandate - Switch to another company - Open Direct Debit Mandate list view Issue: The DD mandate from the other company is displayed. Any user who has access to DD mandates will view the DD mandates from all companies, even those from the companies he has no access. Cause: There is no multi-company rule for "sdd.mandate" model. opw-3769026 Forward-Port-Of: odoo/enterprise#59233