Daily updates from Odoo
Friday, October 3, 2025
3 changes
1 change
Security fixes and vulnerability patches
This fix prevents helpdesk tickets from being linked to a customer belonging to a different company. It helps ensure users only see and access tickets they are authorized to handle, avoiding cross-company visibility issues and related errors.
Original PR description
**Issue**: It is possible to associate a partner that belongs to a different company than the ticket’s company. As a result, some users could see tickets in the list view that they should not have access to. When attempting to open those tickets, an error was raised. Even worse, in some cases (see the associated ticket), certain users were still able to access them. **Steps to reproduce**: - Create two companies (A and B) - Switch to company A - Open the Helpdesk application - Create and open a ticket - Select both companies A and B - Assign a partner linked to company B to the ticket - Save it opw-4926497 Forward-Port-Of: odoo/enterprise#93201
1 change
Security fixes and vulnerability patches
Sensitive Saudi payroll fields are now only visible to authorized payroll users. This helps protect employee compensation-related information and restores the expected access controls.
Original PR description
Some payroll-related fields in the Saudi HR localization (hr.version form view) were missing group restrictions. As a result, non-payroll users could see sensitive fields such as: - l10n_sa_iqama_annual_amount - l10n_sa_medical_insurance_annual_amount - l10n_sa_work_permit_annual_amount This broke the payroll access test (test_payroll_fields_access), which ensures sensitive payroll information is only visible to users in the Payroll group. We add the missing groups="hr_payroll.group_hr_payroll_user" restriction on these fields in the form view so that only authorized users can access them. build_error-231290
1 change
Security fixes and vulnerability patches
This fix prevents Helpdesk tickets from being linked to a customer belonging to a different company. It protects multi-company data visibility so users only see and access tickets appropriate to their company.
Original PR description
**Issue**: It is possible to associate a partner that belongs to a different company than the ticket’s company. As a result, some users could see tickets in the list view that they should not have access to. When attempting to open those tickets, an error was raised. Even worse, in some cases (see the associated ticket), certain users were still able to access them. **Steps to reproduce**: - Create two companies (A and B) - Switch to company A - Open the Helpdesk application - Create and open a ticket - Select both companies A and B - Assign a partner linked to company B to the ticket - Save it opw-4926497 Forward-Port-Of: odoo/enterprise#93201