Wednesday, August 26, 2026
1 change · saas-19.4
Security fixes and vulnerability patches
Database API keys used when creating a database from a template are now masked so they cannot be read in plain text. This strengthens protection of sensitive credentials while keeping database creation from templates working as expected.
Original PR description
This commit is a follow-up to 8741c123997438beb56fa065667b431616c809a5 which hardens the security of the `database_api_key` field on `project.project`. The issue is that a similar field is still accessible on the wizard allowing the creation of a database from a template, `project.template.create.wizard`. With this commit, the field is masked in the same way. A test checks that the key cannot be read in cleartext from the ORM any more, and that the database creation still initialize the correct key. Forward-Port-Of: odoo/enterprise#128810 Forward-Port-Of: odoo/enterprise#128596