Daily updates from Odoo
Saturday, May 11, 2024
1 change
Security fixes and vulnerability patches
This update prevents users from deleting attachments in messages they didn't create or author. Previously, any user who could view a message could delete its attachments, which could result in loss of important files. Now only the attachment creator or the message author can delete attachments, ensuring better control over shared documents.
Original PR description
Currently only the author of a message or an admin is allowed to edit a message However any user that can see a message in a chatter can delete the attachments linked to it. While it isn't usually a big issue, it still seems unreasonable to allow anyone to delete potentially important attachments from messages. task-3519815 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#165060 Forward-Port-Of: odoo/odoo#157970