Daily updates from Odoo
Tuesday, January 20, 2026
2 changes
1 change
Resolved issues and error corrections
This update prevents unauthorized access to the Point of Sale system when it's locked by an employee. Previously, users could bypass the login screen using the browser back button. The fix ensures that users are always redirected to the login screen, maintaining POS security.
Original PR description
When the POS is locked by an employee (pos_hr module active and no cashier logged in), users could bypass the login screen by using the browser back button. Steps to reproduce: ------------------- * Install pos_hr module * Open a POS session and log in as an employee * Lock the POS * Use browser back button to navigate back > Observation: The POS reopens without requiring employee login, allowing unauthorized access to protected pages. Why the fix: ------------ The handleUrlParams method now checks if pos_hr is active and if no cashier is logged in before processing URL parameters. If an unauthenticated user tries to access a protected page (other than LoginScreen), they are automatically redirected to the LoginScreen. This ensures that the POS security is maintained even when using browser navigation. opw-5400719
1 change
Resolved issues and error corrections
This update fixes a security vulnerability in Odoo 17.0 where users could access Verifactu certificates for all companies, regardless of their permissions. The change restricts access to certificates based on company affiliation, ensuring data security and compliance. This prevents unauthorized access to sensitive business documents.
Original PR description
**PROBLEM** In 17.0, you can access the verifactu certificate of all companies. **STEP TO REPRODUCE** - Have 2 companies. - Create a certificate for each of them. - Setup Marc Demo with the Accountant role for the invoicing/accounting app. - Remove him from the ES company. - When accessing the verifactu certificate view, he will still have access to the ES company certificate. opw-5354383