Daily updates from Odoo
Wednesday, July 2, 2025
4 changes
1 change
Security fixes and vulnerability patches
This update fixes access control around salary contract pages so users can only view contract information they are permitted to access. It helps protect sensitive employee and compensation data while maintaining expected behavior in the salary configurator.
Original PR description
Backport: b642714d658d7180ab70ea171ad006e975c36449 task-4881974 Forward-Port-Of: odoo/enterprise#88776 Forward-Port-Of: odoo/enterprise#88489
1 change
Security fixes and vulnerability patches
This fix strengthens access checks around employee salary contracts so users only interact with contracts they are allowed to view or manage. It helps protect sensitive contract information and reduces the risk of unauthorized access in salary package workflows.
Original PR description
Backport: b642714d658d7180ab70ea171ad006e975c36449 task-4881974 Forward-Port-Of: odoo/enterprise#88776 Forward-Port-Of: odoo/enterprise#88489
2 changes
Security fixes and vulnerability patches
This update closes a permissions gap that could allow employees to change approved expense information when they should only be able to edit drafts. It helps protect approved expense records from unauthorized changes and strengthens expense approval controls.
Original PR description
The state changes right check was only done on specific method but it wasn't check at write level. Which allowed to bypass it. The record rule on hr_expense_user without a check on the state is in draft allow to change data on approved expense sheets. forward port : #189360
This fixes access control around salary contract pages so users can only view or interact with contracts they are allowed to access. It helps protect sensitive employee compensation information and reduces the risk of unauthorized exposure.
Original PR description
Backport: b642714d658d7180ab70ea171ad006e975c36449 task-4881974 Forward-Port-Of: odoo/enterprise#88776 Forward-Port-Of: odoo/enterprise#88489