Daily updates from Odoo
Monday, October 21, 2024
2 changes
1 change
Security fixes and vulnerability patches
This fix ensures that permissions for checking user groups are based on the person making the request, not the user being checked. It prevents portal or external users from accessing group information they should not see while allowing internal users to perform valid checks.
Original PR description
The code comment says non-internal users should not have access to has_group if it's not for themselves. But the code checked the group of the targetted user, not the current user. Added test failed without fix failed because an AssertError was not raised, and an AssertError was raised when it should not have. note: found when reviewing 18.0 forward-port of d0828eecf60f7c8622d6875b opw-4096073
1 change
Resolved issues and error corrections
This fix prevents automated email scanners from accidentally changing the status of signature requests. Previously, security scanners that check links in emails could trigger HTTP HEAD requests that would mark sign requests as ignored without any user action. Now the system properly handles these scanner requests so they don't affect the actual signature workflow.
Original PR description
Issue: Mail scanners can send HTTP HEAD requests to links contained in emails, which can change the state of a sign request without user action. Steps: - send a sign request - look in mailhog to get the notification mail - copy the link at the bottom of the mail and `curl --head <url>` - the sign request is now ignored opw-4217355