Daily updates from Odoo
Thursday, January 22, 2026
1 change
Security fixes and vulnerability patches
This update fixes a security vulnerability where users could bypass the POS login screen when the POS was locked. The system now automatically redirects users to the login screen if unauthorized access is attempted, ensuring only authorized personnel can access the POS system. This enhances the security and integrity of our point-of-sale operations.
Original PR description
When the POS is locked by an employee (pos_hr module active and no cashier logged in), users could bypass the login screen by using the browser back button. Steps to reproduce: ------------------- * Install pos_hr module * Open a POS session and log in as an employee * Lock the POS * Use browser back button to navigate back > Observation: The POS reopens without requiring employee login, allowing unauthorized access to protected pages. Why the fix: ------------ The handleUrlParams method now checks if pos_hr is active and if no cashier is logged in before processing URL parameters. If an unauthenticated user tries to access a protected page (other than LoginScreen), they are automatically redirected to the LoginScreen. This ensures that the POS security is maintained even when using browser navigation. opw-5400719 Forward-Port-Of: odoo/odoo#244757 Forward-Port-Of: odoo/odoo#240965