Daily updates from Odoo
Wednesday, July 9, 2025
3 changes
Security fixes and vulnerability patches
VoIP permissions were updated so users can only view and manage calls, providers, and related records appropriate to their role and company. New officer and administrator roles make access easier to manage while reducing the risk of users seeing or changing data outside their responsibility.
Original PR description
- Introduced new user groups for VoIP officers and administrators with specific access rights to calls and providers. - Updated access rules to restrict CRUD operations based on company affiliation. - Added demo data for testing user access rights. This commit improves the overall security and usability of the VoIP module, ensuring that users can only access relevant data based on their roles and company associations. Task-3695951
UK HMRC and CIS reporting records now store related files directly instead of linking through a shared attachment record. This reduces the risk of users gaining unintended access to other documents and improves data protection for tax-related files.
Original PR description
This is part of a general change for all the many2one ir.attachment fields to binary to avoid security issues, as many2one would allow access to all ir.attachment records. task-4771709
WhatsApp attachment deletion now uses a temporary, limited access token instead of a permanent one. This reduces security risk while making the deletion process simpler and easier to maintain.
Original PR description
This is a follow up to odoo/odoo#204830 to replace the permanent access token with a temporary one for deleting the attachment. Aside from the security benefit, this change makes the `mail_attachment_delete` route flow and associated helper methods simpler and more straightforward. Related to: odoo/odoo#208066 task-4746347