Odoo Changelog — 2026-02-05

Thursday, February 5, 2026

2 changes · master

Security(2)

Security fixes and vulnerability patches

[IMP] http: move session methods

EnterprisemasterfrontdeskHIGH

This update strengthens the security of Odoo Enterprise by limiting direct access to the core session object. Developers are now encouraged to use the session as a dictionary, reducing potential vulnerabilities and improving overall system stability. This change enhances the security posture of the application.

Original PR description

The session is a critical object.
The goal of this commit is to limit its exposure.

Developers should use the session as a dictionary (`MutableMapping`).
Developers should (generally) not use internal logic that processes the
session.

To achieve this, this commit moves the methods from the `Session` class
to make them module-level functions.

Task-5882018

#security#session#enterprise

[FIX] sale_amazon: stop logging access tokens

PR #106423

Enterprisemastersale_amazonHIGH

This update fixes a security vulnerability where temporary customer data credentials (RDTs) were being logged in application logs. This prevented sensitive information like buyer names and addresses from being exposed outside of controlled systems, reducing the risk of data breaches. The change prevents logging of sensitive data during certain operations.

Original PR description

Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext.

RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely.

This commit adds a parameter to disable logging for operations that return sensitive data.

opw-5491878

Forward-Port-Of: odoo/enterprise#105178

#security#data protection#RDT

The session is a critical object. The goal of this commit is to limit its exposure. Developers should use the session as a dictionary (`MutableMapping`). Developers should (generally) not use internal logic that processes the session. To achieve this, this commit moves the methods from the `Session` class to make them module-level functions. Task-5882018

Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext. RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely. This commit adds a parameter to disable logging for operations that return sensitive data. opw-5491878 Forward-Port-Of: odoo/enterprise#105178