Wednesday, November 19, 2025
1 change · saas-18.3
Resolved issues and error corrections
When users type @ in a channel, the suggested people to mention are now limited to the channel’s authorized group. This prevents people from seeing or selecting mentions for users outside the intended group, improving privacy and access control in discussions.
Original PR description
Before this commit it would be possible to mention any partner in a discuss channel with an Authorized Group (group_public_id). Steps to reproduce: 1. Log as Mitchell Admin 2. Open Administrator channel 3. Write "@" in composer to get mentions 4. Observe having non-administrator partners This happens because we don't send the `group_public_id` record client side (`_field_store_repr` replaces it with the group name), and as such the suggestion service does not correctly filter for partners in the Authorized Group. This commit fixes the issue by correctly sending the `group_public_id` field of the channel. task-5258925 Forward-Port-Of: odoo/odoo#235478