Odoo Security Fix Timeline

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail the…

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote…

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances beca…

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer…

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization modul…

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because u…

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service.

Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service.

odoo · odoo

No Community commit message citing this CVE has been ingested yet. Upstream may disclose without embedding the CVE id in the Git subject.

[FIX] reqs: bump up recommended version In light of CVE-2018-18074, using python-requests 2.20.0 is recommended, or any distribution-specific version that was patched.

[FIX] reqs: bump up recommended version In light of CVE-2018-18074, using python-requests 2.20.0 is recommended, or any distribution-specific version that was patched. See also https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074

Odoo · Odoo

[IMP] web: StaticList: support SET (6) orm command

Modules: web

[IMP] web: StaticList: support SET (6) orm command Before this commit, `_applyCommands` didn't support SET command (command 6). As a consequence, this command had to be special-cased in `_preprocessX2manyChanges`, and in an override of `Record` in the ai_fields addon [1]. With this commit, the SET command is now supported in `_applyCommands`, and a `set()` function has been added on StaticList for convenience. Note: since [2], onchange no longer returns SET commands (it only returns commands from 0 to 4). So this commit adapts a historical test that still simulated an onchange returning a SET command as first command. No task, but followup of [3] [1] https://github.com/odoo-dev/enterprise/blob/366f0376644d4aecd239378782d2db896ea7bf9f/ai_fields/static/src/model/relational_model/record.js#L26 [2] https://github.com/odoo/odoo/pull/119510 [3] https://github.com/odoo/enterprise/pull/830…

[IMP] web: StaticList: support CLEAR (5) orm command

Modules: web

[IMP] web: StaticList: support CLEAR (5) orm command Before this commit, the StaticList didn't expose a way to apply a CLEAR command (command 5), i.e. to empty the relation. This commit adds a `clear()` function to do so, and adds the support of the CLEAR command in `_applyCommands`. Note: since [1], onchange no longer returns CLEAR commands (it only returns commands from 0 to 4). So this commit adapts a few historical tests that still simulated onchanges returning a CLEAR command as first command. Request for task~5350021 [1] https://github.com/odoo/odoo/pull/119510 Part-of: odoo/odoo#249054 Related: odoo/enterprise#107694

[REF] web_tour: prepare to change the default action in tour_compiler

Modules: account, mail, point_of_sale, pos_hr, pos_restaurant, pos_self_order, project, purchase_product_matrix

[REF] web_tour: prepare to change the default action in tour_compiler Currently, in tour_compiler, to check that an element is actually present in the DOM in a step, there are 2 possibilities. - `isCheck: true` => Checks that the element is in the DOM. The latter can be disabled. - `run() {}` => Checks that the element is in the DOM (because this is what is done by default). However, if the element is disabled, the step will be aborted. In the codebase, we can see a lot of `run() {} //it's a check` and `isCheck:true`. However, the behavior is not exactly the same. What's more, there are 2 ways to do "the same thing". In order to clarify the turns API, it was decided to no longer put an action (step.run) by default. (Previously, the default action was the "click" action). From then on, it is no longer necessary to stipulate `step.isCheck: true` nor `run() {}`. The corollary is that now…

[IMP] payment stripe: migrate to a direct payment flow

Modules: payment, payment_stripe, sale

[IMP] payment stripe: migrate to a direct payment flow The Reserve Bank of India (RBI) issued a directive (amended subsequently in December 2020 and March 2021) that introduces additional security measures for recurring payments on India-issued cards. These measures include: - Banks must register cardholders and create an e-mandate through a one-time process, using additional factor authentication (AFA) like 3D Secure (3DS). - Banks must alert cardholders at least 24 hours before charges take place and give them the ability to opt out of transactions. - Recurring transactions over 15,000 INR (or equivalent in other currencies) must go through AFA each time. Stripe has worked with a partner platform to support that, but we must manipulate the PaymentIntent and SetupIntent objects directly through their dedicated API, which the Checkout API does not allow. Therefore, we must now…

[FIX] reqs: bump up recommended `requests` version

[FIX] reqs: bump up recommended `requests` version In light of CVE-2018-18074, using python-requests 2.20.0 is recommended, or any distribution-specific version that was patched. See also https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074