Daily updates from Odoo
Wednesday, April 1, 2026
2 changes
1 change
Resolved issues and error corrections
This update fixes a security issue where cached relationship data (like linked tags or contacts) could show records a user shouldn't have access to. Previously, if an administrator accessed a record's relationships first, regular users would see the same unrestricted data from cache. Now the system properly filters cached data based on each user's actual permissions, ensuring users only see records they're authorized to view.
Original PR description
The values in cache are put in sudo and filtered when converting to records. This way, no matter who reads the field first, the cache contains all ids of corecords which we can filter as we convert from cache to recordset. In other words, `record.tag_ids` returns accessible tags to the current user linked to the record. However, if we had code `record.sudo().tag_ids` that returned all records, `record.tag_ids` would return the same records afterwards directly from cache. Now we filter only accessible corecords before returning them.
1 change
Resolved issues and error corrections
This fix closes a loophole that allowed users to change tax settings while a Point of Sale session was active. Previously, the system only prevented changes to certain tax fields, but missed the price_include_override field which controls tax-inclusive pricing. This could cause discrepancies between receipts and invoices. The fix adds this field to the protected list so users cannot modify tax behavior mid-session.
Original PR description
There is a safeguard in account.tax.write prevents modifying taxes as it is forbidden to modify a tax used in a POS order not posted. This guard only applies for a predefined set of fields in…
There is a safeguard in account.tax.write prevents modifying taxes as it is forbidden to modify a tax used in a POS order not posted. This guard only applies for a predefined set of fields in account_tax.py. After 18.0, the tax-included behavior is controlled through the `price_include_override` field instead of `price_include`. However, this field was not added in the forbidden fields, allowing users to modify tax inclusion while a POS session is open. This bypasses the safeguard and can lead to inconsistencies, as the POS caches tax configuration at session start. For example, changing this setting mid-session may differences between POS receipts and backend invoices. By adding `price_include_override` to the forbidden fields, the UserError can properly be raised. Additional note: test_fiscal_position_between_frontend_and_backend was updated to close the POS session before changing taxes since the safeguard now correctly blocks this. Related ticket: opw-6042367 Forward-Port-Of: odoo/odoo#255895 Forward-Port-Of: odoo/odoo#254487