Thursday, September 4, 2025
1 change · saas-18.3
Security fixes and vulnerability patches
HR teams can once again find employee documents from the employee record, even when document settings were missing or not fully migrated. Employee folders are also kept system-owned rather than assigned to the employee, reducing unintended access to sensitive HR files.
Original PR description
Since migration of https://github.com/odoo/enterprise/pull/80399, some companies cannot retrieve easily their hr documents because their documents hr settings are not activated or not properly…
Since migration of https://github.com/odoo/enterprise/pull/80399, some companies cannot retrieve easily their hr documents because their documents hr settings are not activated or not properly configured. With the new implementation, employee form view smart button redirect to the hr employee folder of the target employee. But if this folder does not exists after the migration or if the documents we not correctly placed in the HR folder before the migration, HR officers cannot retrieve the employees documents. This fix makes the smart button redirect to employee folder if the settings are corrects and activated, but uses the old way to retrieve documents across the whole app if the setting is not active. I both cases, the smart button works as it should. Also, we force having no owner on employee folders to avoid access gain by the applicant themselves when they sign their contract, creating a new employee with the applicant user in the context (making them, by default, owner of the created folder). Task-4869292