Daily updates from Odoo
Friday, October 17, 2025
3 changes
2 changes
Security fixes and vulnerability patches
Access to product feed data is now limited to administrators and website editors. This helps prevent broader internal access to product information through feed links, reducing the risk of unintended data exposure.
Original PR description
Previously, the `product_feed` model was accessible to all internal users, which was overly permissive and allowed access to all products via the feed URL. This commit restricts access to the `product_feed` model, limiting it to administrators and website editors only. --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr
Point of Sale now only allows backend access for the employee linked to the currently connected user, instead of any manager employee. Managers can still close POS sessions, preserving operational control while reducing unintended access.
Original PR description
Task: [5154178](https://www.odoo.com/odoo/project/1737/tasks/5154178) --- Previously, any employee with the role `manager` could go to the backend. Now, the only employees that can go back to the backend are those binded to the user connected. Managers can still close the session. Forward-Port-Of: odoo/odoo#231735 Forward-Port-Of: odoo/odoo#230756
1 change
Security fixes and vulnerability patches
IoT Boxes now check that a database has a valid token before connecting. This helps prevent unauthorized or misconfigured connections, improving protection for connected devices and business data.
Original PR description
We added a check to prevent IoT Boxes from connecting to a database if the database doesn't have a valid token. Task: 5177501