Daily updates from Odoo
Monday, July 6, 2026
2 changes
1 change
Resolved issues and error corrections
This update strengthens the website's security by preventing unauthorized users from subscribing to stock notifications for unavailable products or using existing customer email addresses. The change adds validation to ensure subscriptions are legitimate and prevents potential misuse of user accounts, enhancing overall system security.
Original PR description
Description of the issue/feature this PR addresses: Currently, in the website_sale_stock module, there is no backend validation when subscribing to notifications for products without stock. This…
Description of the issue/feature this PR addresses: Currently, in the website_sale_stock module, there is no backend validation when subscribing to notifications for products without stock. This allows public users to potentially use emails that belong to registered accounts. Current behavior before PR: Users could subscribe to stock notifications for products that don’t exist or cannot be added (no stock). Public users could use emails already associated with registered accounts, allowing them to subscribe on behalf of another user. No validation is enforced, leading to potential security issues. Desired behavior after PR is merged: Adding a subscription for a non-existent or unavailable product raises a ValidationError. Public users trying to subscribe with an email that belongs to a registered user receive an AccessError prompting them to sign in first. Backend validation prevents misuse of registered user emails and improves security. --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#273691 Forward-Port-Of: odoo/odoo#271880
1 change
Security fixes and vulnerability patches
Website helpdesk forms now verify that preset hidden or injected values have not been changed in the browser before submission. This helps prevent users from tampering with customized form settings and makes altered submissions fail rather than silently accepting unsafe values.
Original PR description
Website forms can be customized using the website editor. These customized values are directly embedded in the form in a hidden input or injected via the `data-for` js mechanism. This commit ensures that these values are not modified by the client. It is necessary to generate the token after the rendering (in `_render_template`) because we don't know all the values to sign using only the stored arch. In fact, several values are dynamically computed during the rendering (see `data-for` and `t-att-data-values` tags attributes); these "js injected" values take precedence over the default values. It is better to raise an error than to correct the values when the form has been improperly modified by the end user. Task-6320608