Wednesday, July 16, 2025
3 changes · saas-18.4
Security fixes and vulnerability patches
Websocket messages sent from Odoo to IoT Boxes are now signed to confirm they come from a valid user. This helps protect connected IoT devices from unauthorized client messages and aligns the process with existing request validation.
Original PR description
As websocket messages to IoT Boxes are sent from the Odoo client, we need to ensure it is sent from a valid user. We then sign using the database generated token (same as longpolling requests). Enterprise PR: odoo/enterprise#89849 Task: 4933216
Websocket messages sent to IoT Boxes are now signed to confirm they come from a valid Odoo user. This strengthens trust in IoT communications and helps prevent unauthorized client messages from being accepted.
Original PR description
As websocket messages to IoT Boxes are sent from the Odoo client, we need to ensure it is sent from a valid user. We then sign using the database generated token (same as longpolling requests). Community PR: odoo/odoo#218139 Task: 4933216
Barcode line descriptions now keep their line breaks without relying on a less safe rendering method. This improves the security and reliability of barcode screens while keeping the same appearance for users.
Original PR description
This commit replaces the usage of unsafe `markup` with the CSS property: `white-space: pre-wrap` for showing the line description in barcode. Previously, `markup` was used to preserve the line breaks in the line description by replacing all `\n`s with `<br/>` which required using `markup` to render the text properly. However, the above mentioned CSS property achieves the same exact result by not ignoring the line breaks in the original string.