Odoo Security Fix Timeline

Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed…

Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to acce…

Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage col…

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to…

Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privi…

The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a data…

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other use…

Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on beh…

Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection.

Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote).

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.

Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitr…

Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into invi…

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

[IMP] web: StaticList: support SET (6) orm command

Modules: web

[IMP] web: StaticList: support SET (6) orm command Before this commit, `_applyCommands` didn't support SET command (command 6). As a consequence, this command had to be special-cased in `_preprocessX2manyChanges`, and in an override of `Record` in the ai_fields addon [1]. With this commit, the SET command is now supported in `_applyCommands`, and a `set()` function has been added on StaticList for convenience. Note: since [2], onchange no longer returns SET commands (it only returns commands from 0 to 4). So this commit adapts a historical test that still simulated an onchange returning a SET command as first command. No task, but followup of [3] [1] https://github.com/odoo-dev/enterprise/blob/366f0376644d4aecd239378782d2db896ea7bf9f/ai_fields/static/src/model/relational_model/record.js#L26 [2] https://github.com/odoo/odoo/pull/119510 [3] https://github.com/odoo/enterprise/pull/830…

[IMP] web: StaticList: support CLEAR (5) orm command

Modules: web

[IMP] web: StaticList: support CLEAR (5) orm command Before this commit, the StaticList didn't expose a way to apply a CLEAR command (command 5), i.e. to empty the relation. This commit adds a `clear()` function to do so, and adds the support of the CLEAR command in `_applyCommands`. Note: since [1], onchange no longer returns CLEAR commands (it only returns commands from 0 to 4). So this commit adapts a few historical tests that still simulated onchanges returning a CLEAR command as first command. Request for task~5350021 [1] https://github.com/odoo/odoo/pull/119510 Part-of: odoo/odoo#249054 Related: odoo/enterprise#107694

[REF] web_tour: prepare to change the default action in tour_compiler

Modules: account, mail, point_of_sale, pos_hr, pos_restaurant, pos_self_order, project, purchase_product_matrix

[REF] web_tour: prepare to change the default action in tour_compiler Currently, in tour_compiler, to check that an element is actually present in the DOM in a step, there are 2 possibilities. - `isCheck: true` => Checks that the element is in the DOM. The latter can be disabled. - `run() {}` => Checks that the element is in the DOM (because this is what is done by default). However, if the element is disabled, the step will be aborted. In the codebase, we can see a lot of `run() {} //it's a check` and `isCheck:true`. However, the behavior is not exactly the same. What's more, there are 2 ways to do "the same thing". In order to clarify the turns API, it was decided to no longer put an action (step.run) by default. (Previously, the default action was the "click" action). From then on, it is no longer necessary to stipulate `step.isCheck: true` nor `run() {}`. The corollary is that now…

[IMP] payment stripe: migrate to a direct payment flow

Modules: payment, payment_stripe, sale

[IMP] payment stripe: migrate to a direct payment flow The Reserve Bank of India (RBI) issued a directive (amended subsequently in December 2020 and March 2021) that introduces additional security measures for recurring payments on India-issued cards. These measures include: - Banks must register cardholders and create an e-mandate through a one-time process, using additional factor authentication (AFA) like 3D Secure (3DS). - Banks must alert cardholders at least 24 hours before charges take place and give them the ability to opt out of transactions. - Recurring transactions over 15,000 INR (or equivalent in other currencies) must go through AFA each time. Stripe has worked with a partner platform to support that, but we must manipulate the PaymentIntent and SetupIntent objects directly through their dedicated API, which the Checkout API does not allow. Therefore, we must now…

[FIX] reqs: bump up recommended `requests` version

[FIX] reqs: bump up recommended `requests` version In light of CVE-2018-18074, using python-requests 2.20.0 is recommended, or any distribution-specific version that was patched. See also https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074