Odoo Changelog — 2025-09-29

Monday, September 29, 2025

2 changes · saas-18.4

Bug Fixes(2)

Resolved issues and error corrections

[FIX] project: prevent project users from creating stages in list view

Coresaas-18.4projectSecurity

Project users can no longer create new task stages from the task list when they do not have the required permissions. This keeps project workflows controlled by authorized managers and prevents unintended changes to task stage setup.

Original PR description

Steps to reproduce:
- Go to a project
- Open the task list view
- Select a task
- In the `Stage` field, attempt to create a new stage

Issue:
- Project users were able to create new task stages from the task list view, despite not having the required permissions.

Cause:
- The `_default_user_id` method assigns the current user as the owner `user_id` of a new stage only when `default_project_id` is not present in the context. As a result, the method returned the current user’s ID, unintentionally making them the owner of the stage. This allowed project users to bypass the intended access rules and create new stages.

Solution:
- Use the `no_create` option for users outside the project manager group to prevent them from creating new stages.
- Updated the `stage_id` field in the task list view to explicitly include `default_project_id` in the context, ensuring proper access control of that stage.

task-4628666

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#228766
Forward-Port-Of: odoo/odoo#206407

#permissions#project#task stages

[18.0][FIX] analytic: Add company filter to analytic distribution

PR #228935

Coresaas-18.4analyticwebSecurity

The analytic distribution account selector now only shows accounts for the document's company. This prevents users in multi-company setups from viewing or selecting accounts that belong to another company, supporting proper data separation and compliance with company rules.

Original PR description

**Description of the issue/feature this PR addresses:** When creating or editing an analytic distribution, the analytic account selection does not respect the company context. This allows users to…

**Description of the issue/feature this PR addresses:**
When creating or editing an analytic distribution, the analytic account selection does not respect the company context.
This allows users to see and select analytic accounts from other companies, which violates the multi-company record rules.

<img width="669" height="333" alt="2025-09-08_09-28" src="https://github.com/user-attachments/assets/488eb4b1-fdfa-49ca-a57e-8f46a264107d" />


**Current behavior before PR:**
The analytic account dropdown in the analytic distribution widget shows analytic accounts from all companies, instead of being restricted to the current company.

**Desired behavior after PR is merged:**
The analytic account selection in the analytic distribution widget is filtered by company.
Only analytic accounts belonging to the document company will be displayed, ensuring compliance with multi-company record rules.




---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#228268
Forward-Port-Of: odoo/odoo#225835

Steps to reproduce: - Go to a project - Open the task list view - Select a task - In the `Stage` field, attempt to create a new stage Issue: - Project users were able to create new task stages from the task list view, despite not having the required permissions. Cause: - The `_default_user_id` method assigns the current user as the owner `user_id` of a new stage only when `default_project_id` is not present in the context. As a result, the method returned the current user’s ID, unintentionally making them the owner of the stage. This allowed project users to bypass the intended access rules and create new stages. Solution: - Use the `no_create` option for users outside the project manager group to prevent them from creating new stages. - Updated the `stage_id` field in the task list view to explicitly include `default_project_id` in the context, ensuring proper access control of that stage. task-4628666 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#228766 Forward-Port-Of: odoo/odoo#206407

**Description of the issue/feature this PR addresses:** When creating or editing an analytic distribution, the analytic account selection does not respect the company context. This allows users to see and select analytic accounts from other companies, which violates the multi-company record rules. <img width="669" height="333" alt="2025-09-08_09-28" src="https://github.com/user-attachments/assets/488eb4b1-fdfa-49ca-a57e-8f46a264107d" /> **Current behavior before PR:** The analytic account dropdown in the analytic distribution widget shows analytic accounts from all companies, instead of being restricted to the current company. **Desired behavior after PR is merged:** The analytic account selection in the analytic distribution widget is filtered by company. Only analytic accounts belonging to the document company will be displayed, ensuring compliance with multi-company record rules. --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#228268 Forward-Port-Of: odoo/odoo#225835