17.0#49
Open
arunrajiah wants to merge 19 commits intomainfrom
Open
Conversation
This release closes the issues reported on r/Odoo (jeconti's audit) and is the recommended upgrade for everyone running 17.0.6.0.0 or earlier. 1. WhatsApp webhook now verifies Meta's X-Hub-Signature-256 (HMAC-SHA256 of the raw body, keyed with the App Secret). Without a configured secret OR a valid signature, the endpoint returns 403. Closes the impersonation hole that let any internet attacker who guessed the webhook URL act as any linked WhatsApp user. 2. Telegram webhook secret is now mandatory. The Register-webhook action auto-generates a 32-byte URL-safe secret if one isn't set and registers it with Telegram. The endpoint rejects any request whose X-Telegram-Bot-Api-Secret-Token header doesn't match. 3. Confirmation callbacks are bound to a per-write nonce. Each staged write generates a fresh secrets.token_urlsafe(12) stored on the session row; the Yes/No payload carries it as confirm:yes:<nonce> and is verified in constant time before execution. Defends against prompt-injection that tries to swap the staged tool between staging and the user clicking Yes. 4. Magic-link tokens moved to a dedicated odoopilot.link.token model that stores SHA-256 digests only and consumes the row atomically on use. Hourly cron garbage-collects expired entries. Re-issuing a token for the same chat invalidates the previous one. Migration: post-migration.py clears in-flight pending writes (pre-7.0 confirmations didn't carry a nonce) and removes legacy link-token system parameters. Operators must re-register the Telegram webhook once and paste their Meta App Secret into Settings. Other changes: - Tests: tests/test_security.py covers HMAC verify, nonce rotation, hashed token storage, and single-use consumption. - ACL: new odoopilot.link.token row in ir.model.access.csv. - Cron: ir_cron_gc_link_tokens runs hourly. - Listing/README: removed all "vs competitor" / pricing-comparison framing per project direction; replaced with a Security model section and feature-only descriptions. Version bumped 17.0.6.0.0 -> 17.0.7.0.0.
CI's ruff format --check step was failing on the 4 files added/modified in 17.0.7.0.0. No behavioural change -- pure formatting.
github-actions
Bot
added
addon
Mirror of the same file on main: GitHub Security Advisories as the preferred private channel, supported-version table, scope definitions, and a one-paragraph threat model.
Mirror of main:8dfa511. Five additional findings surfaced after shipping 17.0.7.0.0: 1. Magic-link CSRF (High) — split GET (preview) / POST (consume) flow. 2. Identity hijack (High) — refuse to overwrite an existing different-user link. 3. Wildcard write-target hijack (High) — preflight resolves before staging. 4. Cost-amplification DoS (Medium) — rate limit + bounded worker pool. 5. Webhook delivery non-idempotency (Medium) — dedup table. Regression tests for all five in tests/test_security.py.
…, hygiene Mirror of main:fb9b624. Closes four lower-impact findings from the post-17.0.7 internal review: * Bot token scrub in services/telegram.py error logs. * hmac.compare_digest for WhatsApp verify_token. * Rename dispatch env -> sudo_env with trust-boundary docstrings. * Defensive else+log for malformed callback payloads. Regression tests in tests/test_security.py.
Mirror of main:5c13d6f. Removes background/background-color and styled <a> tags (both stripped by the sanitiser); uses plain URL text so the auto-linker can emit clickable links.
Mirror of main:8e4828b. Adds Sponsor / Feedback / Bug Report / Security links + quick-reference row to the in-Odoo Settings -> OdooPilot page.
Mirror of main:aa820c3. Reframes the listing, manifest and README around the killer use case: your internal team uses Odoo without logging in to Odoo. Adds a 'day in the life' section with employee scenarios, an adoption-gap before/after table, and an explicit 'not for customers' callout.
Mirror of main:2db091d. Bumps manifest to 17.0.10.0.0 and adds the CHANGELOG entry covering: four-card community panel in Settings, listing redesign for the App Store sanitiser, and the marketing repositioning around 'your team uses Odoo without logging in to Odoo'.
…ter) Mirror of main:ccd9840. Banner regenerated for the new pitch, bandit + semgrep added to CI as advisory scanners, and a new listing-renderable job catches regressions of the three patterns the App Store sanitiser breaks (background, white text, styled <a>).
Mirror of main:f84664a. Adds the regenerated banner at the top, redraws the architecture diagram for both channels, fixes the Quickstart for auto-generated Telegram secret + mandatory WhatsApp App Secret, lists the actual default LLM models from services/llm.py, expands Security to cover every post-audit fix, replaces the stale roadmap with current release status, and updates the sponsor block with the four GitHub links that also appear in the in-Odoo settings panel.
Mirror of main:9de5126. Adds activity-summary computed fields on odoopilot.identity (last_activity, message_count_7d, success_rate_7d) read in batched read_group calls; rebuilds the Linked Users list view with decoration, filters, group-bys and a smart-button form; rebuilds the Audit Log view with failure-decoration, time/outcome/tool filters, five group-bys, and a default 'last 7 days grouped by day' open. Seven new regression tests in tests/test_admin_views.py.
Mirror of main:ac4bb65. CI triggers on *.0 branches; SECURITY.md table lists 18.0 as Alpha; CHANGELOG header notes the branch split.
Mirror of main:8420571. Adds services/scope_guard.py (regex pre-filter catching prompt extraction, jailbreaks, role hijacks, delimiter injection, code-gen, creative content, off-topic compute) and hardens SYSTEM_PROMPT with explicit scope rules and trust boundary. Disable flag at odoopilot.scope_guard_enabled. Tests pin 22 legitimate queries as pass-through and 32 attack strings as blocked.
Mirror of main:20613ae. Adds find_partner (read) plus 5 write tools (clock_in/out, submit_expense, submit_timesheet, create_calendar_event) all flowing through the existing preflight + nonce + audit pipeline. Tool count: 13 -> 19. New tests/test_employee_tools.py with registry- hygiene + preflight-validation coverage.
…next sprint Mirror of main.
Mirror of main:fee1391. Hardens scope guard against Unicode + foreign- language bypasses, rebinds employee_id to env.uid in submit_expense and submit_timesheet, caps find_partner limit at 25, opportunistic GC of empty rate-limiter buckets, asserts -> RuntimeErrors.
Mirror of main.
Mirror of main. Updates README install + status + roadmap and SECURITY.md supported-versions table to reflect that the 18 series is live at apps.odoo.com/apps/modules/18.0/odoopilot.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related issue
Closes #
Type of change
Checklist
ruff formatpasses)ruff checkwith no errorsScreenshots (if UI change)