Tuesday, August 26, 2025
1 change · saas-18.3
Security fixes and vulnerability patches
Website search results now respect page visibility settings and access rules, so visitors no longer see restricted pages they cannot open. The fix also improves search filtering for empty queries and excludes pages that are not meant to be indexed.
Original PR description
Searching for pages on a website requires sudo. Because of this the ACL and visibility criteria checks are not applied on the delivered results, making pages with restricted visibility returned in the results. Scenario: - add a search widget on the website - restrict a page to a given group - search terms of that page with a user without that group Result: the page is shown in the search results. Fix: handle visibility criteria the same way as we do it in the ir.ui.view()._handle_visibility method, and prevent showing unaccessible pages in the autocomplete results. Also adds access rule checks to ensure custom ACLs are taken into account. This commit also fixes: - the lack of filtering when using an empty search term - filtering out the non indexed pages opw-3964793 opw-4930197 Forward-Port-Of: odoo/odoo#222919 Forward-Port-Of: odoo/odoo#219344