Daily updates from Odoo
Tuesday, July 29, 2025
1 change
Security fixes and vulnerability patches
The portal chatter no longer lets users copy message links when they access a shared document without normal read access. This helps prevent document access tokens from being accidentally exposed through copied links.
Original PR description
Before this commit, it was possible for a user to copy the link of messages in the chatter of a portal document accessed via share link with token. This could lead to unintentionally leaking the access token of the document. This commit fixes the issue by removing the possibility to copy links of messages inside portal documents for which a user has no read access. discussed in task-4551910