Daily updates from Odoo
Monday, October 27, 2025
3 changes
1 change
Security fixes and vulnerability patches
This fix prevents users from bypassing approval-related restrictions when editing expense records. It helps protect approved expense sheets from unauthorized changes and keeps expense workflows compliant with expected access rights.
Original PR description
The state changes right check was only done on specific method but it wasn't check at write level. Which allowed to bypass it. The record rule on hr_expense_user without a check on the state is in draft allow to change data on approved expense sheets. forward port : #189360 Forward-Port-Of: odoo/odoo#217203 Forward-Port-Of: odoo/odoo#216850
1 change
Security fixes and vulnerability patches
This update prevents employees from changing approved expense sheets by bypassing normal permission checks. It strengthens control over expense approvals so finalized records remain protected from unauthorized edits.
Original PR description
The state changes right check was only done on specific method but it wasn't check at write level. Which allowed to bypass it. The record rule on hr_expense_user without a check on the state is in draft allow to change data on approved expense sheets. forward port : #189360 Forward-Port-Of: odoo/odoo#217203 Forward-Port-Of: odoo/odoo#216850
1 change
Security fixes and vulnerability patches
This update prevents users from bypassing approval-stage restrictions on expense records. It helps protect approved expense sheets from unauthorized changes and keeps expense controls consistent.
Original PR description
The state changes right check was only done on specific method but it wasn't check at write level. Which allowed to bypass it. The record rule on hr_expense_user without a check on the state is in draft allow to change data on approved expense sheets. forward port : #189360 Forward-Port-Of: odoo/odoo#217203 Forward-Port-Of: odoo/odoo#216850