Conversation
Contributor
|
|
mav-adhoc
force-pushed
the
18.0-h-127390-mav
branch
from
September 15, 2026 12:53
59339a2 to
7a2511e
Compare
…ublic job form The public check_recent_application route appended the recruiter name, email and phone to the duplicate application warning, so any visitor could enumerate them from the job form. Override it to return the same warning without the contact, as the core does from Odoo 20 on.
mav-adhoc
force-pushed
the
18.0-h-127390-mav
branch
from
September 15, 2026 15:08
7a2511e to
36aa295
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
El endpoint público
/website_hr_recruitment/check_recent_application(auth="public") agrega al aviso de postulación duplicada el nombre, el email y el teléfono del reclutador asignado (recruiter_contact, enwebsite_hr_recruitment/controllers/main.py). Como la ruta se consulta por nombre, email, teléfono o LinkedIn, cualquier visitante del portal de empleo puede enumerar esos datos.Este módulo overridea el controller para devolver el mismo aviso sin el contacto. En
masterel core ya eliminó el endpoint completo, así que el cambio se adelanta a esa decisión.Se copia el método entero en vez de recortar el mensaje que devuelve el nativo: así un cambio de wording o de traducción aguas arriba no puede reintroducir el dato en silencio.
Test plan
tests/test_check_recent_application.py: el aviso no contiene nombre, email ni teléfono del reclutador.'zzrecruiter@example.com' unexpectedly found in 'An application already exists for ... In case of issue, contact ...'.0 failed, 0 error(s) of 1 tests.Ticket: https://www.adhoc.inc/odoo/helpdesk.ticket/127390