Tuesday, August 25, 2026
1 change · saas-19.1
Security fixes and vulnerability patches
A sensitive database API key used during template-based database creation is now hidden from direct access. This reduces the risk of exposing credentials while preserving the normal database creation process.
Original PR description
This commit is a follow-up to 8741c123997438beb56fa065667b431616c809a5 which hardens the security of the `database_api_key` field on `project.project`. The issue is that a similar field is still accessible on the wizard allowing the creation of a database from a template, `project.template.create.wizard`. With this commit, the field is masked in the same way. A test checks that the key cannot be read in cleartext from the ORM any more, and that the database creation still initialize the correct key. Forward-Port-Of: odoo/enterprise#128596