Daily updates from Odoo
Friday, July 10, 2026
2 changes
1 change
Resolved issues and error corrections
This update strengthens the security of our payment processing by ensuring only the transaction reference is used, rather than all payment data. This prevents potential vulnerabilities and ensures the system only processes data it needs to find and trigger payment processing, improving overall system stability.
Original PR description
The `/payment/custom/process` was blindly processing any payment data it was receiving while its only purpose is to find the transaction from the posted arguments and trigger its processing. This commit clarifies that only the transaction reference is expected as an argument and reconstructs the payment data payload from it.
1 change
Resolved issues and error corrections
This update strengthens the website's security by preventing users from subscribing to products that don't exist or using another user's email address. It now validates product availability and requires users to sign in before subscribing, reducing the risk of unauthorized access and misuse of accounts.
Original PR description
Description of the issue/feature this PR addresses: Currently, in the website_sale_stock module, there is no backend validation when subscribing to notifications for products without stock. This…
Description of the issue/feature this PR addresses: Currently, in the website_sale_stock module, there is no backend validation when subscribing to notifications for products without stock. This allows public users to potentially use emails that belong to registered accounts. Current behavior before PR: Users could subscribe to stock notifications for products that don’t exist or cannot be added (no stock). Public users could use emails already associated with registered accounts, allowing them to subscribe on behalf of another user. No validation is enforced, leading to potential security issues. Desired behavior after PR is merged: Adding a subscription for a non-existent or unavailable product raises a ValidationError. Public users trying to subscribe with an email that belongs to a registered user receive an AccessError prompting them to sign in first. Backend validation prevents misuse of registered user emails and improves security. --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#274937 Forward-Port-Of: odoo/odoo#271880