Wednesday, April 9, 2025
1 change · saas-18.1
Security fixes and vulnerability patches
Product label previews in Inventory no longer call an external service that could receive sensitive product and pricing data. Users will see a standard placeholder instead of a rendered ZPL label preview until a local preview solution is available.
Original PR description
In `07df9a2` a preview for the zpl labels of products was added in `stock`. In order to generate this preview the `labelary` api was used. The fact the server calls an external API with enterprise data (pricing information associated with product) automatically is in breach of our privacy policies. In this commit we remove the api call. The user will now see the default placeholder image instead of the rendered label. The plan is to later find a way to render the label locally. Task 4555651 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr