Thursday, April 30, 2026
1 change · saas-18.4
Security fixes and vulnerability patches
The point of sale customer display now verifies that requests include the correct access token before showing display content. This helps prevent unauthorized access to POS display information and strengthens protection around customer-facing checkout screens.
Original PR description
In this commit we adapt the `PosCustomerDisplay` controller such that it checks that the correct `pos.access_token` was sent. Task: 6144690 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#261545