Daily updates from Odoo
Friday, August 22, 2025
1 change · master
Security fixes and vulnerability patches
An internal system object is no longer exposed through remote calls, reducing unintended access to backend internals. This change removes redundant behavior without affecting normal business workflows.
Original PR description
`BaseModel.pool` was exposed in RPC because it is considered as a public method: it is callable, not prefixed by `_`, not decorated with `@api.private`. There's no reason to expose this object in RPC, and `__call__` is redundant with `__getitem__`.