Daily updates from Odoo
Tuesday, August 19, 2025
1 change
Security fixes and vulnerability patches
Copied links from public or portal chatter now open the correct page instead of an unauthorized access page. The change improves customer and visitor access to shared discussion links while preventing token exposure for documents they cannot read.
Original PR description
Before this commit, links produced by the "Copy Link" action on portal or public chatters would redirect to an unathorized page. This happens because the route used in the link would check access rights to the message, which public and portal users usually don't have. This commit fixes the issue by overriding the link route in modules with public chatter such that it would redirect to the page containing the chatter. This commit also removes the possibility to copy links of messages inside portal documents for which a user has no read access to avoid leaking the access token. task-4551910