Daily updates from Odoo
Friday, September 12, 2025
1 change · 19.0
Security fixes and vulnerability patches
Website search now respects page visibility rules, so users only see pages they are allowed to access. This prevents restricted or non-indexed pages from appearing in autocomplete and search results, including when the search term is empty.
Original PR description
Searching for pages on a website requires sudo. Because of this the ACL and visibility criteria checks are not applied on the delivered results, making pages with restricted visibility returned in the results. Scenario: - add a search widget on the website - restrict a page to a given group - search terms of that page with a user without that group Result: the page is shown in the search results. Fix: handle visibility criteria the same way as we do it in the ir.ui.view()._handle_visibility method, and prevent showing unaccessible pages in the autocomplete results. Also adds access rule checks to ensure custom ACLs are taken into account. This commit also fixes: - the lack of filtering when using an empty search term - filtering out the non indexed pages opw-3964793 opw-4930197 Forward-Port-Of: odoo/odoo#222919 Forward-Port-Of: odoo/odoo#219344