Wednesday, August 26, 2026
1 change · saas-19.3
Security fixes and vulnerability patches
This update prevents database API keys from being read in clear text when creating a database from a template. It closes a security gap while keeping database creation working as expected.
Original PR description
This commit is a follow-up to 8741c123997438beb56fa065667b431616c809a5 which hardens the security of the `database_api_key` field on `project.project`. The issue is that a similar field is still accessible on the wizard allowing the creation of a database from a template, `project.template.create.wizard`. With this commit, the field is masked in the same way. A test checks that the key cannot be read in cleartext from the ORM any more, and that the database creation still initialize the correct key. Forward-Port-Of: odoo/enterprise#128810 Forward-Port-Of: odoo/enterprise#128596