Wednesday, August 27, 2025
1 change · saas-18.4
Security fixes and vulnerability patches
The Copy Link action now sends public and portal users to the correct page containing the discussion message instead of an unauthorized page. It also prevents copying links to inaccessible portal document messages, reducing the risk of exposing access tokens.
Original PR description
Before this commit, links produced by the "Copy Link" action on portal or public chatters would redirect to an unathorized page. This happens because the route used in the link would check access rights to the message, which public and portal users usually don't have. This commit fixes the issue by overriding the link route in modules with public chatter such that it would redirect to the page containing the chatter. This commit also removes the possibility to copy links of messages inside portal documents for which a user has no read access to avoid leaking the access token. task-4551910 Forward-Port-Of: odoo/odoo#223752 Forward-Port-Of: odoo/odoo#202555