Wednesday, December 18, 2024
1 change
Security fixes and vulnerability patches
The time off overview now prevents employees without the right permissions from grouping other employees' absences by time off type, avoiding exposure of sensitive absence details. It also restores the ability to open the “View” option from the overview without triggering an access error.
Original PR description
FIX 1: Before this commit, it was possible for anyone to group by time off type on the overview, allowing users without the right to see the time off type of other employee's leaves. Steps to reproduce: - Log with an employee without time off rights - Go on the time off overview so that you see leaves that aren't for the user - add a groupby on time off type This commit adds a group constraint on that field for the overview. FIX 2: Before this commit, PR odoo/odoo#188393 introduced a restriction on the `leave_id` field for the overview, breaking at the same time the "view" option. Steps to reproduce: - Log with an employee without time off rights - Go on the time off overview - click on any leave - click on "View" - an access error is raised This commit adds some sudo where needed to fetch the info on the `leave_id` field while keeping the restriction introduced in the mentioned PR. task-4381185