Daily updates from Odoo
Monday, October 21, 2024
1 change
Security fixes and vulnerability patches
This fix ensures that permissions for checking user groups are based on the person making the request, not the user being checked. It prevents portal or external users from accessing group information they should not see while allowing internal users to perform valid checks.
Original PR description
The code comment says non-internal users should not have access to has_group if it's not for themselves. But the code checked the group of the targetted user, not the current user. Added test failed without fix failed because an AssertError was not raised, and an AssertError was raised when it should not have. note: found when reviewing 18.0 forward-port of d0828eecf60f7c8622d6875b opw-4096073