Daily updates from Odoo
Sunday, January 25, 2026
1 change
Security fixes and vulnerability patches
This update fixes a security vulnerability where users could bypass the POS login screen after locking the POS. The system now automatically redirects users to the login screen if unauthorized access is detected, ensuring only authorized personnel can access the POS when locked.
Original PR description
When the POS is locked by an employee (pos_hr module active and no cashier logged in), users could bypass the login screen by using the browser back button. Steps to reproduce: ------------------- * Install pos_hr module * Open a POS session and log in as an employee * Lock the POS * Use browser back button to navigate back > Observation: The POS reopens without requiring employee login, allowing unauthorized access to protected pages. Why the fix: ------------ The handleUrlParams method now checks if pos_hr is active and if no cashier is logged in before processing URL parameters. If an unauthenticated user tries to access a protected page (other than LoginScreen), they are automatically redirected to the LoginScreen. This ensures that the POS security is maintained even when using browser navigation. opw-5400719 Forward-Port-Of: odoo/odoo#245120 Forward-Port-Of: odoo/odoo#240965