Daily updates from Odoo
Monday, July 7, 2025
1 change
Security fixes and vulnerability patches
This update makes Odoo more consistent about what contact and user data is shared through messaging, live chat, calendar, project, ratings, and website learning features. It helps prevent private details such as email addresses from being exposed to the wrong audience while keeping information available where appropriate for internal users.
Original PR description
\* = calendar, crm_livechat, hr_holidays, im_livechat, project, rating, website_livechat, website_slides There are many flows in which we need to build Store data for a specific target, as different…
\* = calendar, crm_livechat, hr_holidays, im_livechat, project, rating, website_livechat, website_slides There are many flows in which we need to build Store data for a specific target, as different targets have different needs and different ACL. For example, we usually don't want to send email address to non-internal users as this is considered a private data. However we are fine with returning the email address to internal users by default. This is currently implemented with `for_current_user` on a case by case (specific store methods of specific models), which leads to inconsistencies and carelessness: some models have for_current_user as False by default, other as True, some would need the param but currently don't define it, some methods check if the current user is internal but don't verify the target at all (internal users can broadcast to other non-internal users), etc. This commits brings this feature in a more robust way directly into the Store. https://github.com/odoo/enterprise/pull/88531