Daily updates from Odoo
Wednesday, July 30, 2025
1 change · saas-18.3
Security fixes and vulnerability patches
Portal users can no longer copy direct message links from shared documents when they do not have normal read access. This reduces the risk of accidentally exposing document access tokens through copied chatter links.
Original PR description
Before this commit, it was possible for a user to copy the link of messages in the chatter of a portal document accessed via share link with token. This could lead to unintentionally leaking the access token of the document. This commit fixes the issue by removing the possibility to copy links of messages inside portal documents for which a user has no read access. discussed in task-4551910 Forward-Port-Of: odoo/odoo#221032