Daily updates from Odoo
Wednesday, May 8, 2024
1 change
Security fixes and vulnerability patches
This update strengthens privacy controls in the Calendar module by preventing administrators who aren't invited to private events from viewing sensitive event details. Additionally, only event attendees can now edit event information, preventing unauthorized modifications. This ensures that private calendar events remain truly private regardless of user permissions.
Original PR description
Before this commit, through the list view and form view, private events were being accessed by administrators who were not invited to those private events. These events should have their sensitive…
Before this commit, through the list view and form view, private events were being accessed by administrators who were not invited to those private events. These events should have their sensitive fields hidden. Additionally, uninvited users could edit public events information since they are editable in the event form view. After this commit, we filter the sensitive fields from private events through the _fetch_query method even when the current user has group "Settings", or is in superuser mode: thus uninvited administrators won't be able to read the private event's sensitive information anymore. After hiding the private event information, the values are also updated in the cache. This override covers overs all variations of read(), search_read() and export_data() regarding securing the event private information. Additionally, the form view is now more strict regarding the editing of events for users that are not event attendees: for them, the event fields are now readonly. task-3837646 Forward-Port-Of: odoo/odoo#164788 Forward-Port-Of: odoo/odoo#159913