Saturday, May 10, 2025
1 change · master
Enhancements to existing features
Appointment forms can now be embedded on existing external websites for visitors who are not logged in. This makes it easier for businesses to use Odoo appointment scheduling without immediately adopting the full Odoo website integration, while keeping logged-in sessions protected.
Original PR description
Remove CSRF check on appointment forms if there is no session or no associated user for the session. We consider this safe as we already accept logged-out creation of appointment and do not modify any existing data so long as no user is logged in. In that way it is similar to regular form snippets which already work this way since odoo/odoo@b192d8d23f83b35c21b13f6e4516c18897b80201 This greatly eases embedding this form on existing websites for users who do not wish to use our website integration immediately but still want the benefits of the app and the ease of use of the form page. task-4593880