Daily updates from Odoo
Friday, July 10, 2026
2 changes · 17.0
Security fixes and vulnerability patches
Website forms embedded in Helpdesk pages now protect signed fields from being changed in the browser before submission. This improves the integrity of customized website forms without changing the experience for visitors or editors.
Original PR description
Website forms can be customized using the website editor. These customized values are directly embedded in the form in a hidden input or injected via the data-for js mechanism. For website forms whose action is the route `/website/form/`, this commit ensures that input marked with `data-sign='true'` are not modified by the client. The signature is prepared during the compilation phase, and the signature is calculated at runtime (during rendering) to take into account values rendered dynamically. HTML fields do not pass through the QWeb engine. For this field the form signature is calculated statically. Passing embedded forms within HTML fields through the pre-compilation step allows their signatures to be determined since these forms are static. This mechanism is completely transparent to the end user. Task-6320608
Website forms now include a built-in integrity check so customized hidden values cannot be altered in the browser before submission. This helps ensure helpdesk and other website form data remains trustworthy without changing the user experience.
Original PR description
WIP Task-6320608