Wednesday, August 26, 2026
1 change · saas-19.2
Security fixes and vulnerability patches
This update closes a security gap where database API keys could still be viewed through the database template creation process. The keys are now masked there as well, while preserving the ability to create databases correctly from templates.
Original PR description
This commit is a follow-up to 8741c123997438beb56fa065667b431616c809a5 which hardens the security of the `database_api_key` field on `project.project`. The issue is that a similar field is still accessible on the wizard allowing the creation of a database from a template, `project.template.create.wizard`. With this commit, the field is masked in the same way. A test checks that the key cannot be read in cleartext from the ORM any more, and that the database creation still initialize the correct key. Forward-Port-Of: odoo/enterprise#128810 Forward-Port-Of: odoo/enterprise#128596