Daily updates from Odoo
Wednesday, March 26, 2025
1 change · master
Security fixes and vulnerability patches
Luxembourg EC Sales stored reports now keep report files directly on the report record instead of linking to a shared attachment record. This reduces the risk of unintended access to other attachments while giving users a direct download button for the report.
Original PR description
This is part of a general change for all the many2one ir.attachment fields to binary in order to avoid security issues as the former would allow access to all ir.attachment records. ### Before - the attachment field of the stored sales report model used to be many2one - in the 'EC Sales - Stored Reports' one could access the attachment record - the display_name was computed but not used in the view ### Now - the attachment field of the stored sales report model is now a binary field - instead of access to attachment record, there is now a button to download report - upgrade script is provided for database changes - display_name is now in the view task-3177630