Daily updates from Odoo
Wednesday, July 1, 2026
1 change
Resolved issues and error corrections
This update makes sure users can only access detailed accounting move lines if they belong to the correct accounting groups. It reduces the risk of showing sensitive accounting data to users who should only have limited access, such as portal users.
Original PR description
Using check_access on the model alone is not enough, as some groups (like portal) could have access to the model itself but rely on record rules (which we now bypass) for filtering access to actual records. This check is there for extra-safety (the access rules to account.report should anyway prevent access) ; we fix it by explicitly checking the user has the proper accounting groups. Forward-Port-Of: odoo/enterprise#120749