Daily updates from Odoo
Wednesday, February 4, 2026
6 changes
1 change
Security fixes and vulnerability patches
This update fixes a security vulnerability where temporary customer data credentials (RDTs) were being logged in application logs. This prevented sensitive information like buyer names and addresses from being exposed outside of controlled environments, reducing potential data breaches. The change prevents logging of RDTs during specific operations.
Original PR description
Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext. RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely. This commit adds a parameter to disable logging for operations that return sensitive data. opw-5491878 Forward-Port-Of: odoo/enterprise#105178
1 change
Security fixes and vulnerability patches
This update fixes a security vulnerability where temporary credentials (RDTs) were being logged in Odoo's system logs. This prevented sensitive customer information, like names and addresses, from potentially being exposed in support tickets or monitoring reports. The change now prevents logging of these credentials, strengthening data protection.
Original PR description
Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext. RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely. This commit adds a parameter to disable logging for operations that return sensitive data. opw-5491878 Forward-Port-Of: odoo/enterprise#105178
1 change
Security fixes and vulnerability patches
This update fixes a security vulnerability where temporary customer data credentials (RDTs) were being logged in application logs. This prevented sensitive information like buyer names and addresses from being exposed outside of controlled environments, reducing potential data breaches. The change prevents logging of RDTs during specific operations.
Original PR description
Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext. RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely. This commit adds a parameter to disable logging for operations that return sensitive data. opw-5491878 Forward-Port-Of: odoo/enterprise#105178
1 change
Security fixes and vulnerability patches
This update fixes a security vulnerability by preventing the logging of sensitive access tokens (RDTs) used to access customer data. Previously, these tokens were inadvertently exposed in application logs, increasing the risk of unauthorized access. This change enhances data protection and aligns with security best practices.
Original PR description
Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext. RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely. This commit adds a parameter to disable logging for operations that return sensitive data. opw-5491878 Forward-Port-Of: odoo/enterprise#105178
1 change
Security fixes and vulnerability patches
This update fixes a potential security vulnerability by preventing the logging of sensitive access tokens (RDTs) generated by the Amazon connector. These tokens contain customer data and, if exposed in logs, could lead to privacy breaches. This change enhances data protection and aligns with security best practices.
Original PR description
Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext. RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely. This commit adds a parameter to disable logging for operations that return sensitive data. opw-5491878 Forward-Port-Of: odoo/enterprise#105178
1 change
Security fixes and vulnerability patches
This update fixes a security vulnerability where temporary credentials (RDTs) used to access customer data were being logged in application logs. This prevented sensitive information like buyer names and addresses from being exposed outside of controlled environments, reducing the risk of data breaches. The change disables logging for operations handling these sensitive credentials.
Original PR description
Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext. RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely. This commit adds a parameter to disable logging for operations that return sensitive data. opw-5491878 Forward-Port-Of: odoo/enterprise#105178