Daily updates from Odoo
Tuesday, July 14, 2026
4 changes
1 change
Security fixes and vulnerability patches
This change prevents database API keys from being exposed through normal application access or displayed in the user interface. It reduces the risk of accidental leaks, such as during screen sharing, by only showing masked values and limiting real key access to direct database access.
Original PR description
The aim of this commit is to harden the security of the `database_api_key` field. Before this commit: The field could be retrieved through the orm and could be leaked if the access rights were bypassed. A streamer pasting the key in the field could also leak his api key by mistake. After this commit: The only way to access the field is through direct SQL access. The api key isn't shown anymore in the UI: - The UI doesn't receive the key from the backend: it receives dummy **** - The field in the form view display dots instead of any char to prevent leaking the key by mistake. Task-id: None Forward-Port-Of: odoo/enterprise#123962 Forward-Port-Of: odoo/enterprise#122163
1 change
Security fixes and vulnerability patches
This update prevents database API keys from being exposed through normal application access or accidentally shown on screen. Users will now see masked placeholders instead of the real key, reducing the risk of credential leaks.
Original PR description
The aim of this commit is to harden the security of the `database_api_key` field. Before this commit: The field could be retrieved through the orm and could be leaked if the access rights were bypassed. A streamer pasting the key in the field could also leak his api key by mistake. After this commit: The only way to access the field is through direct SQL access. The api key isn't shown anymore in the UI: - The UI doesn't receive the key from the backend: it receives dummy **** - The field in the form view display dots instead of any char to prevent leaking the key by mistake. Task-id: None Forward-Port-Of: odoo/enterprise#123826 Forward-Port-Of: odoo/enterprise#122163
1 change
Security fixes and vulnerability patches
Database API keys are now better protected from accidental or unauthorized exposure. The system no longer sends the real key to the user interface and masks the field on screen, reducing the risk of sensitive credentials being leaked.
Original PR description
The aim of this commit is to harden the security of the `database_api_key` field. Before this commit: The field could be retrieved through the orm and could be leaked if the access rights were bypassed. A streamer pasting the key in the field could also leak his api key by mistake. After this commit: The only way to access the field is through direct SQL access. The api key isn't shown anymore in the UI: - The UI doesn't receive the key from the backend: it receives dummy **** - The field in the form view display dots instead of any char to prevent leaking the key by mistake. Task-id: None Forward-Port-Of: odoo/enterprise#123826 Forward-Port-Of: odoo/enterprise#122163
1 change
Security fixes and vulnerability patches
Employee payroll details in Swiss, Indonesian, Turkish, and US ADP payroll areas are now limited to authorized payroll users. This helps prevent non-payroll staff from viewing sensitive compensation-related information and fixes an access control gap.
Original PR description
This commit adds `groups="hr_payroll.group_hr_payroll_user"` to all fields displayed inside payroll tab in the form view of employee to make sure those fields are only accessible to payroll users. runbot-error-234071 Forward-Port-Of: odoo/enterprise#122293