Monday, September 30, 2024
1 change · saas-17.4
Enhancements to existing features
Odoo can now skip creating device log entries for specific technical or automated sessions when an authorized administrator enables that option. This helps reduce unnecessary audit noise while keeping other logging and tracking mechanisms in place, but it should be used carefully because it affects user-visible device history.
Original PR description
In some situations it is useful to avoid generating useless device logs, e.g. for automated technical sessions, platform-generated request, etc. This commit introduces support for a `_trace_disable` session flag to do so. This should never be done without a proper assessment of the consequences for auditability, as seen from the user's point of view. Note that non-admin users have no direct or indirect way to set this flag, so it shouldn't be an extra security risk. Privileged users would have different technical ways to set it, but they could just as easily delete the generated logs or modify them. Also noteworthy: such sessions will of course still be subject to all other auditing mechanisms (server logs, web proxy logs, metadata tracking on modified records, etc.)