Daily updates from Odoo
Wednesday, October 8, 2025
4 changes
2 changes
Security fixes and vulnerability patches
The POS employee login screen now avoids triggering browser password saving or autofill prompts. This helps protect shared checkout devices by reducing the chance that one employee's access code is stored or suggested for another user.
Original PR description
*=point_of_sale Following this commit: ==== - Replaced 'password' input type with masked 'text' input to prevent browsers from offering to save or autofill credentials on the splash screen. - This improves security in shared device environments, especially when multiple employees access the system on the same device. task-4800745 Forward-Port-Of: odoo/odoo#211040
Resolved issues and error corrections
Shared employee profile links that include restricted information now show a clear access message instead of crashing. Users without permission are redirected to the public employee list, and a new test helps prevent similar issues from returning.
Original PR description
Sharing a link of an employee profile containing private info generated a traceback. Permissions had to be applied to the private field. I've also put a more explicit error message that allows the user to get redirected to the public employee list. I couldn't find a way to get the employee id from the url before the generic permission warning comes in. Thus I had to resort to redirecting to the general public employees list. Other tracebacks may happen each time a private field without the corresponding groups is put in the xml. Thus I added a test to prevent us from doing that again. Forward-Port-Of: odoo/odoo#229611 Forward-Port-Of: odoo/odoo#228623
1 change
Security fixes and vulnerability patches
The point of sale employee login screen now avoids triggering browser password saving and autofill prompts. This helps protect employee access codes on shared devices, reducing the chance that one employee’s credentials are reused by someone else.
Original PR description
*=point_of_sale Following this commit: ==== - Replaced 'password' input type with masked 'text' input to prevent browsers from offering to save or autofill credentials on the splash screen. - This improves security in shared device environments, especially when multiple employees access the system on the same device. task-4800745 Forward-Port-Of: odoo/odoo#211040
1 change
Security fixes and vulnerability patches
The POS employee login screen now avoids triggering browser password saving or autofill prompts. This helps protect employee credentials on shared devices where multiple staff members access the same point-of-sale system.
Original PR description
*=point_of_sale Following this commit: ==== - Replaced 'password' input type with masked 'text' input to prevent browsers from offering to save or autofill credentials on the splash screen. - This improves security in shared device environments, especially when multiple employees access the system on the same device. task-4800745 Forward-Port-Of: odoo/odoo#211040