Daily updates from Odoo
Thursday, June 4, 2026
2 changes
1 change
Security fixes and vulnerability patches
This update strengthens the security of customer links within the Point of Sale module by ensuring the necessary authorization token is always included. Previously, the system was vulnerable to unauthorized access, and this fix centralizes the token handling for consistent and secure operation. This enhances overall system security.
Original PR description
The `customerDisplayPath` getter was missing the `access_token` parameter, which is required for proper authorization. Because of this, the `openCustomerDisplay` method was manually constructing its own URL to include the token. This commit centralizes the logic by appending the `access_token` directly to the `customerDisplayPath` getter. The dialog opener now reuses this property, ensuring consistency and preventing missing tokens if the path is accessed elsewhere. Forward-Port-Of: odoo/odoo#267985
1 change
Security fixes and vulnerability patches
This update strengthens the security of customer display links within the Point of Sale module. Previously, a critical authorization issue meant links were constructed without the necessary access token. This fix centralizes the token handling, ensuring all customer display links are properly secured and authorized.
Original PR description
The `customerDisplayPath` getter was missing the `access_token` parameter, which is required for proper authorization. Because of this, the `openCustomerDisplay` method was manually constructing its own URL to include the token. This commit centralizes the logic by appending the `access_token` directly to the `customerDisplayPath` getter. The dialog opener now reuses this property, ensuring consistency and preventing missing tokens if the path is accessed elsewhere. Forward-Port-Of: odoo/odoo#267985