Thursday, August 21, 2025
1 change · saas-18.2
Security fixes and vulnerability patches
Copying links from public or portal chatter messages now sends users to the relevant page instead of an unauthorized error. The change also prevents link copying where it could expose private access tokens, improving safe sharing for website sales and eLearning pages.
Original PR description
Before this commit, links produced by the "Copy Link" action on portal or public chatters would redirect to an unathorized page. This happens because the route used in the link would check access rights to the message, which public and portal users usually don't have. This commit fixes the issue by overriding the link route in modules with public chatter such that it would redirect to the page containing the chatter. This commit also removes the possibility to copy links of messages inside portal documents for which a user has no read access to avoid leaking the access token. task-4551910 Forward-Port-Of: odoo/odoo#202555