Tuesday, July 15, 2025
1 change · saas-18.1
Security fixes and vulnerability patches
This update fixes a permissions gap that could let employees change approved expense information by bypassing the normal state-change checks. It strengthens access controls so expense records can only be edited when allowed, helping protect approved expense data from unauthorized changes.
Original PR description
The state changes right check was only done on specific method but it wasn't check at write level. Which allowed to bypass it. The record rule on hr_expense_user without a check on the state is in draft allow to change data on approved expense sheets. forward port : #189360 Forward-Port-Of: odoo/odoo#216850