Daily updates from Odoo
Wednesday, June 3, 2026
1 change
Security fixes and vulnerability patches
This update strengthens the security of customer display links within the Point of Sale module. Previously, a critical authorization issue meant links were constructed manually, potentially exposing customer data. Now, the access token is consistently included, ensuring proper authorization and protecting customer information.
Original PR description
The `customerDisplayPath` getter was missing the `access_token` parameter, which is required for proper authorization. Because of this, the `openCustomerDisplay` method was manually constructing its own URL to include the token. This commit centralizes the logic by appending the `access_token` directly to the `customerDisplayPath` getter. The dialog opener now reuses this property, ensuring consistency and preventing missing tokens if the path is accessed elsewhere.