Daily updates from Odoo
Friday, August 1, 2025
1 change
Security fixes and vulnerability patches
Public visitors who open links to unpublished products now see a standard “not found” page instead of an access-denied message. This prevents sensitive record details from being exposed and gives shoppers a clearer, safer browsing experience.
Original PR description
Versions -------- - 16.0+ Steps ----- 1. Have an unpublished product; 2. as admin, go to its `/shop` page; 3. copy URL; 4. open URL in private window. Issue ----- > ### 403: Forbidden > > Uh-oh!…
Versions
--------
- 16.0+
Steps
-----
1. Have an unpublished product;
2. as admin, go to its `/shop` page;
3. copy URL;
4. open URL in private window.
Issue
-----
> ### 403: Forbidden
>
> Uh-oh! Looks like you have stumbled upon some top-secret records.
>
> Sorry, Public user (id=4) doesn't have 'read' access to:
- Product (product.template)
>
> If you really, really need access, perhaps you can win over your friendly administrator with a batch of freshly baked cookies.
This is information should not be accessible to public users.
Cause
-----
Commit 06cc322e7e2f added a `_pre_dispatch` override which displays the product name in the URL for SEO purposes. However, when the user does not have access to the product record, it throws an `AccessError`, leading to the HTTP 403 response.
Solution
--------
If an `AccessError` is raised when building the URL for a public user, return a HTTP 404 response, as if the record doesn't exist.
opw-4936500
Forward-Port-Of: odoo/odoo#221039
Forward-Port-Of: odoo/odoo#220948