Daily updates from Odoo
Wednesday, December 24, 2025
2 changes · master
Resolved issues and error corrections
This update improves the customer experience by adding the delivery OTP directly to the receipt. Previously, the receipt only displayed the delivery address, creating confusion for customers. This change ensures customers have immediate access to the OTP needed for delivery.
Original PR description
Before this commit: --------- - Delivery OTP was not shown on the receipt. - Receipt only displayed delivery address without any OTP. After this commit: ------------------- - Display “Delivery OTP ” below the delivery address on the receipt. Task-5048040
This update fixes a security vulnerability where Portal and Internal users could create private knowledge articles without the necessary permissions. The fix ensures that users only have access to create articles when they have the appropriate 'Create' access rights, improving data security and control. UI changes have also been implemented to hide creation buttons for users without the correct permissions.
Original PR description
How to Reproduce : 1. Remove 'Create' access on the 'Knowledge Article' model for Portal and Internal users. 2. Now log in as a Portal. 3. Try to create a new private article. 4. Log in as an…
How to Reproduce :
1. Remove 'Create' access on the 'Knowledge Article' model for Portal and
Internal users.
2. Now log in as a Portal.
3. Try to create a new private article.
4. Log in as an Internal user.
5. Try to create a new private article.
Both Internal and Portal users can still create private articles even after
'Create access' is removed.
Article creation logic in `knowledge.article` was bypassing the usual access
rights because of `sudo` (mainly to add the creator as a member, since creation
rights on the member model are not granted). This allowed users to create
private articles even without create access.
This commit introduces:
1. Model-level access check in `create`. Sudo the creation of articles only when
the user has create rights.
2. UI imp to hide the '+' button in the sidebar and the `New` button in
the topbar when the user doesn't have create access.
3. New test cases to verify that model-level access rights are respected when creating an article.
4. Removed 'create=1' from article embedded list view as it was always displaying 'New' button
irrespective of create rights.
Now it displayed based on create rights.
task-4916280
Forward-Port-Of: odoo/enterprise#102299
Forward-Port-Of: odoo/enterprise#93034