Daily updates from Odoo
Wednesday, August 13, 2025
1 change · 18.0
Security fixes and vulnerability patches
Website search now respects page visibility rules and access permissions, so visitors do not see restricted pages in search or autocomplete results. It also improves filtering for empty searches and excludes pages that should not be indexed.
Original PR description
Searching for pages on a website requires sudo. Because of this the ACL and visibility criteria checks are not applied on the delivered results, making pages with restricted visibility returned in the results. Scenario: - add a search widget on the website - restrict a page to a given group - search terms of that page with a user without that group Result: the page is shown in the search results. Fix: handle visibility criteria the same way as we do it in the ir.ui.view()._handle_visibility method, and prevent showing unaccessible pages in the autocomplete results. Also adds access rule checks to ensure custom ACLs are taken into account. This commit also fixes: - the lack of filtering when using an empty search term - filtering out the non indexed pages opw-3964793 opw-4930197 Forward-Port-Of: odoo/odoo#219344