Daily updates from Odoo
Monday, April 7, 2025
1 change
Security fixes and vulnerability patches
This fix prevents basic Point of Sale employees from closing a shop session just because they are the currently logged-in user. Session-closing access now follows the employee's configured shop permissions, reducing the risk of unauthorized register closure.
Original PR description
Steps to reproduce the bug: - Install point of sales app, employees app - Make a shop and enable multiple employees per session option - Add another user as a basic right user for any shop - Open a…
Steps to reproduce the bug: - Install point of sales app, employees app - Make a shop and enable multiple employees per session option - Add another user as a basic right user for any shop - Open a shop session (the one rights are set up for) - Log out of the current user and log in with the other user account - Open the session - The current logged-in user can close the session despite having basic rights Problem: The close session in the XML was having a condition of pos.employeeIsAdmin, and the employeeIsAdmin flag was checking if the user is having advanced rights on the shop or it is the logged-in Odoo user. So if you are the logged-in user, you will always have the close register option regardless of the access rights you have for a specific shop. opw-4575692 Description of the issue/feature this PR addresses: Current behavior before PR: Desired behavior after PR is merged: --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr