Friday, July 10, 2026
1 change · saas-19.1
Security fixes and vulnerability patches
This change strengthens protection for database API keys by preventing them from being read through normal application access and hiding real key values in the interface. It reduces the risk of sensitive credentials being leaked accidentally or through bypassed access controls.
Original PR description
The aim of this commit is to harden the security of the `database_api_key` field. Before this commit: The field could be retrieved through the orm and could be leaked if the access rights were bypassed. A streamer pasting the key in the field could also leak his api key by mistake. After this commit: The only way to access the field is through direct SQL access. The api key isn't shown anymore in the UI: - The UI doesn't receive the key from the backend: it receives dummy **** - The field in the form view display dots instead of any char to prevent leaking the key by mistake. Task-id: None Forward-Port-Of: odoo/enterprise#122163