Daily updates from Odoo
Monday, June 29, 2026
5 changes
1 change
Resolved issues and error corrections
The website profile page now uses the currently logged-in user when displaying the email verification banner. This prevents another person's private email address from appearing on a public profile page, protecting user privacy.
Original PR description
**Steps to reproduce:**
- Install website_forum module
- Create a new portal user and log in with it
- Go to the website forum to see that the account requires email verification
- Send the verification email to see the green banner ('an email was sent to XX')
- Add XP (karma) points to this user as admin (User > Smart actions > Karma)
- Switch back to the portal account
- Check any public user profile on the forum (`/profile/user/2?forum_id=2`)
- Green banner now displays the private email of the user you're checking
**Issue:**
On the `email_validation_banner` the user field is used for the validation
data, but it is overridden by `_prepare_user_profile_values` which is
setting the current page user.
**Fix:**
Properly set `user` to `env.user` in the template.
opw-6276809
Forward-Port-Of: odoo/odoo#2692492 changes
Enhancements to existing features
This update records device details when a login session appears to come from a different device than the one currently in use. It helps teams spot unusual access patterns and investigate potential account misuse more quickly.
Original PR description
Log device information if fingerprint doesn't match the one currently being used for the current session. Task-6340963 Forward-Port-Of: odoo/odoo#272413
Resolved issues and error corrections
The forum’s email verification banner now shows the correct email tied to the current logged-in user, instead of accidentally exposing the private email of the profile being viewed. This prevents confusing and potentially sensitive information from appearing on public profile pages.
Original PR description
**Steps to reproduce:**
- Install website_forum module
- Create a new portal user and log in with it
- Go to the website forum to see that the account requires email verification
- Send the verification email to see the green banner ('an email was sent to XX')
- Add XP (karma) points to this user as admin (User > Smart actions > Karma)
- Switch back to the portal account
- Check any public user profile on the forum (`/profile/user/2?forum_id=2`)
- Green banner now displays the private email of the user you're checking
**Issue:**
On the `email_validation_banner` the user field is used for the validation
data, but it is overridden by `_prepare_user_profile_values` which is
setting the current page user.
**Fix:**
Properly set `user` to `env.user` in the template.
opw-6276809
Forward-Port-Of: odoo/odoo#2692491 change
Resolved issues and error corrections
This update corrects the validation banner on public forum profiles so it shows the logged-in visitor’s own email status instead of another user’s private email address. It prevents accidental exposure of personal information while keeping the email verification message working as intended.
Original PR description
**Steps to reproduce:**
- Install website_forum module
- Create a new portal user and log in with it
- Go to the website forum to see that the account requires email verification
- Send the verification email to see the green banner ('an email was sent to XX')
- Add XP (karma) points to this user as admin (User > Smart actions > Karma)
- Switch back to the portal account
- Check any public user profile on the forum (`/profile/user/2?forum_id=2`)
- Green banner now displays the private email of the user you're checking
**Issue:**
On the `email_validation_banner` the user field is used for the validation
data, but it is overridden by `_prepare_user_profile_values` which is
setting the current page user.
**Fix:**
Properly set `user` to `env.user` in the template.
opw-6276809
Forward-Port-Of: odoo/odoo#2692491 change
Resolved issues and error corrections
This change makes sure only users with the proper accounting permissions can access detailed move line data in reports. It closes a gap where some users could reach the model but still rely on filtering rules that were no longer enough, improving protection of sensitive accounting information.
Original PR description
Using check_access on the model alone is not enough, as some groups (like portal) could have access to the model itself but rely on record rules (which we now bypass) for filtering access to actual records. This check is there for extra-safety (the access rules to account.report should anyway prevent access) ; we fix it by explicitly checking the user has the proper accounting groups. Forward-Port-Of: odoo/enterprise#120749