Daily updates from Odoo
Wednesday, July 30, 2025
1 change · saas-18.4
Security fixes and vulnerability patches
Users viewing portal documents through shared links can no longer copy direct links to chatter messages when they do not have normal read access. This helps prevent accidental sharing of document access tokens and protects sensitive portal content.
Original PR description
Before this commit, it was possible for a user to copy the link of messages in the chatter of a portal document accessed via share link with token. This could lead to unintentionally leaking the access token of the document. This commit fixes the issue by removing the possibility to copy links of messages inside portal documents for which a user has no read access. discussed in task-4551910 Forward-Port-Of: odoo/odoo#221032