Thursday, September 3, 2026
1 change · 17.0
Security fixes and vulnerability patches
Employee yearly history in Swiss payroll is now limited to records from the user's allowed company context. This prevents staff from seeing employee history belonging to other companies and strengthens company-level data separation.
Original PR description
Add a record rule on model `l10n_ch_employee_yearly_values` to ensure that employees are only visible within their respective companies. This prevents users from viewing yearly history records of…
Add a record rule on model `l10n_ch_employee_yearly_values` to ensure that employees are only visible within their respective companies. This prevents users from viewing yearly history records of employees belonging to other companies, enforcing strict company-based. Steps to Reproduce: ------------------- - Install `l10n_ch_hr_payroll_elm_transmission` - Go to Payroll > Reporting > Employee History - Observe that records are available for all companies. ```psql l10n_ch_fix=# select id,name from res_company ; id | name ----+------------------ 2 | My Swiss Company 1 | YourCompany (2 rows) l10n_ch_fix=# select id,name,company_id from hr_employee where id in (select employee_id from l10n_ch_employee_yearly_values); id | name | company_id ----+-----------------------------------------------+------------ 22 | test2 | 2 23 | test1 | 2 24 | test3 | 2 (3 rows) ``` opw-4985748