Tuesday, January 20, 2026
1 change · saas-18.4
Resolved issues and error corrections
This update prevents unauthorized access to the Point of Sale system when it's locked by an employee. Previously, users could bypass the login screen using the browser back button. The fix ensures that users are always redirected to the login screen, maintaining POS security.
Original PR description
When the POS is locked by an employee (pos_hr module active and no cashier logged in), users could bypass the login screen by using the browser back button. Steps to reproduce: ------------------- * Install pos_hr module * Open a POS session and log in as an employee * Lock the POS * Use browser back button to navigate back > Observation: The POS reopens without requiring employee login, allowing unauthorized access to protected pages. Why the fix: ------------ The handleUrlParams method now checks if pos_hr is active and if no cashier is logged in before processing URL parameters. If an unauthenticated user tries to access a protected page (other than LoginScreen), they are automatically redirected to the LoginScreen. This ensures that the POS security is maintained even when using browser navigation. opw-5400719