Odoo Changelog — 2025-11-12

Wednesday, November 12, 2025

1 change

Security(1)

Security fixes and vulnerability patches

[IMP] documents,stock_barcode,test_l10n_be_hr_payroll_account: Make the logout route POST only

Enterprisemasterdocumentsstock_barcodetest_l10n_be_hr_payroll_accountSECURITY

The logout action now requires an intentional request, preventing users from being unexpectedly signed out by embedded content such as images in messages. This improves session reliability and reduces a minor security risk across affected workflows.

Original PR description

Currently, it is possible to trick and send an image containg 
'/web/session/logout' embedded in the chatter. Anytime, the image gets
loaded, the user gets disconnected which can be pretty annoying.

To avoid such behavior, we made to logout route POST only.

task-5245320

#logout#session#security