Friday, May 2, 2025
1 change · 17.0
Security fixes and vulnerability patches
This fix prevents employees from editing HR Settings in their profile unless they have HR manager permissions. It also ensures personal profile sections such as Resume, Work Information, and Private Information can only be edited when employee self-editing is enabled, reducing the risk of unauthorized HR data changes.
Original PR description
Steps:
- Go to 'My Profile'.
- Check the 'HR Settings' tab and other sections ('Resume', 'Work Information' and 'Private Information').
Issues:
- Users could edit 'HR Settings' without proper HR permissions.
Fix:
- Restricted HR Settings edits to users with HR manager rights.
- Ensured fields in 'Resume', 'Work Information' and 'Private Information' are editable only with hr_employee_self_edit enabled.
task-4319956
Description of the issue/feature this PR addresses:
Current behavior before PR:
Desired behavior after PR is merged:
---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr