Wednesday, December 24, 2025
1 change · 17.0
Resolved issues and error corrections
This update enhances security by ensuring that checks for employee addresses within the account batch payment process are performed with elevated permissions (sudo). Previously, this required users to be part of HR groups, which is now corrected to prevent unauthorized access to employee data. This change addresses a potential security vulnerability.
Original PR description
In commit a6ed1bd, new logic for handling employee addresses was introduced. However, the _get_all_addr function requires employee_ids, which implicitly requires access to the Employees model and, therefore, be in HR groups. During the compute process, _get_all_addr is only used to check whether an employee has an address; no address data is exposed. To fix this issue, the call to _get_all_addr should be executed with sudo(). OPW-5428523