Daily updates from Odoo
Thursday, June 4, 2026
3 changes
2 changes
Security fixes and vulnerability patches
This update strengthens the security of customer links within the Point of Sale module by ensuring the necessary authorization token is always included. Previously, the system was vulnerable to unauthorized access, and this fix centralizes the token handling for consistent and secure operation. This enhances overall system security.
Original PR description
The `customerDisplayPath` getter was missing the `access_token` parameter, which is required for proper authorization. Because of this, the `openCustomerDisplay` method was manually constructing its own URL to include the token. This commit centralizes the logic by appending the `access_token` directly to the `customerDisplayPath` getter. The dialog opener now reuses this property, ensuring consistency and preventing missing tokens if the path is accessed elsewhere. Forward-Port-Of: odoo/odoo#267985
Resolved issues and error corrections
This update ensures that sensitive payroll information, like wages and yearly costs, is only visible to authorized users within the payroll group. A recent change in how tracking messages are generated no longer allows for filtering, so a new system has been implemented to separate and restrict access to these messages.
Original PR description
When a new version is created from the salary configurator, a tracking message summarizing field changes is posted on the employee chatter. This message may contain sensitive payroll information such…
When a new version is created from the salary configurator, a tracking message summarizing field changes is posted on the employee chatter. This message may contain sensitive payroll information such as wage and yearly cost, which should not be visible to users outside the payroll group. Previously, all tracking messages on hr.employee were visible to any user with access to the employee record. After the mail tracking refactor introduced in task (3645865) (https://www.odoo.com/odoo/project/1251/tasks/3645865), tracking values are now rendered directly into the message body, making the old field-level filtering mechanism no longer applicable. To restore payroll visibility restrictions: * Tracking values linked to payroll-restricted fields are separated from regular tracking values during `_track_log`. * Payroll-sensitive tracking values are posted in a dedicated tracking message using the subtype `mt_hr_payroll_sensitive`. * Regular tracking values continue to use the standard tracking flow and remain visible to all users with access to the employee chatter. * Employee chatter message fetching is overridden to hide payroll-sensitive messages from users outside `group_hr_payroll_user`. A test was also added to ensure payroll-sensitive tracking messages remain hidden from non-payroll users. Task: 4985543
1 change
Security fixes and vulnerability patches
This update strengthens the security of customer display links within the Point of Sale module. Previously, a critical authorization issue meant links were constructed without the necessary access token. This fix centralizes the token handling, ensuring all customer display links are properly secured and authorized.
Original PR description
The `customerDisplayPath` getter was missing the `access_token` parameter, which is required for proper authorization. Because of this, the `openCustomerDisplay` method was manually constructing its own URL to include the token. This commit centralizes the logic by appending the `access_token` directly to the `customerDisplayPath` getter. The dialog opener now reuses this property, ensuring consistency and preventing missing tokens if the path is accessed elsewhere. Forward-Port-Of: odoo/odoo#267985