CMS notification (cms_notification)

Security findings

Security warnings

portal_users_can_write_users — ACL grants write on security model 'base.model_res_users' to group 'base.group_portal'. Review field restrictions and Python guards for possible privilege escalation; the ACL alone does not prove exploitability. acl-privilege-escalation · source

Found by automated static analysis: these patterns are usually risky, but only a manual review of the module can confirm a real issue.

Migration considerations

field_widget_notification_selection — Template 'field_widget_notification_selection' uses `t-raw`, deprecated since Odoo 15.0. Prefer `t-out` for escaped output. For intentional HTML, verify sanitization at its source before marking it safe; Markup alone does not sanitize untrusted content. migration-template-t-raw · source

Migration review checklist, not a compatibility verdict. No target version is selected: apply version-specific advice only when migrating to that version or later.

Repository: OCA/website-cms · module folder · Try on Runboat
Module version: 1.0.3
Category: Uncategorized
Folder size: 0.13 MB
License: LGPL-3
Application: No
Auto-installable: No
Website: None
Last tracking update: 2026-08-07 07:25:01
Authors: Camptocamp, Odoo Community Association (OCA)
Maintainers: Camptocamp, Odoo Community Association (OCA)
Committers: Simone Orsi, GitHub, OCA Transbot, oca-travis

Odoo dependencies

OCA/social:

OCA/website-cms:

odoo/odoo:

- website

- web

- base

- web_editor

- web_planner

- http_routing

- portal

- mail

- base_setup

- bus

- web_tour

Python dependencies

None

System dependencies

None

Required by

None

Description

Code Analysis info_outline

Views touched (8)

XML ID	Name	Model	Type	Status
`assets_frontend`	CMS notification frontend assets	ir.ui.view	qweb	Inherits website.assets_frontend
`field_widget_notification_selection`	CMS notification selection widget	ir.ui.view	qweb	Inherits cms_form.field_widget_radio_selection
`listing`	CMS notification listing	ir.ui.view	qweb	New
`mail_message_subtype_form`	mail_digest mail.message.subtype.form	mail.message.subtype	form	Inherits mail.view_mail_message_subtype_form
`message_subtype_tree`	mail_digest mail.message.subtype.tree	mail.message.subtype	tree	Inherits mail.view_message_subtype_tree
`notify_email_help_email`	CMS notification form - notify_email help `Email`	ir.ui.view	qweb	New
`notify_email_help_inbox`	CMS notification form - notify_email help `Inbox`	ir.ui.view	qweb	New
`user_menu`	CMS notification user menu	ir.ui.view	qweb	Inherits website.layout

HTTP endpoints (2)

Route(s)	Handler	Auth	Type	Methods	Flags
`/my/notifications`	`MyNotificationsController.cms_form`	user	http	ALL	website
`/my/settings/notifications`	`PanelFormController.cms_form`	user	http	ALL	website

Models touched (6)

New fields (0)

No new fields.

Public methods (1)

w_option_items(self)
@property

Change options order and inject help text.

New fields (0)

No new fields.

Public methods (4)

check_view_permission(self, item)
Check read permission on given item. We could list messages that are attached to other records. If the permissions for this records has changed then the user viewing the notification may not have permissions to read it anymore.
form_description(self)
@property
form_search_domain(self, search_values)
form_title(self)
@property

New fields (0)

No new fields.

Public methods (7)

form_after_create_or_update(self, values, extra_values)
Update subtype configuration for `_form_subtype_fields`.
form_description(self)
@property
form_get_loader(self, fname, field, main_object=None, value=None, **req_values)
Override to provide automatic loader for boolean fields.
form_msg_success_updated(self)
@property
form_next_url(self, main_object=None)
form_title(self)
@property
form_widgets(self)
@property

New fields (2)

ref_item_id Reference
compute='_compute_ref_item_id' readonly=True selection='_selection_ref_item_id' string='Referenced item'
ref_model_id Many2one → ir.model
comodel_name='ir.model' compute='_compute_ref_model_id' string='Referenced model'

Public methods (2)

is_read(self, partner=None)
is_unread(self, partner=None)

New fields (1)

cms_type Boolean
help="If active, this message subtype will be visible in users' notifications control panel." args: 'Visible in CMS control panel'

Public methods (0)

No public methods.

New fields (1)

has_unread_notif Boolean
compute='_compute_has_unread_notif' readonly=True string='Has unread notif'

Public methods (0)

No public methods.

Loading…

warning Security warnings

build Migration considerations

Code Analysis info_outline

Views touched (8)

HTTP endpoints (2)

Models touched (6)

cms.form.widget.notif_radio New model AbstractModel 0 fields 1 method NotificationSelectionWidget · inherits cms.form.widget.radio

cms.notification.listing New model AbstractModel 0 fields 4 methods CMSNotificationListing · inherits cms.form.search · CMS notification Hold users notifications settings.

cms.notification.panel.form New model AbstractModel 0 fields 7 methods CMSNotificationPanel · inherits cms.form · CMS notification control panel Hold users notifications settings.

mail.message Extends Model 2 fields 2 methods MailMessage · inherits mail.message

mail.message.subtype Extends Model 1 field 0 methods MailMessageSubtype · inherits mail.message.subtype

res.users Extends Model 1 field 0 methods ResUsers · inherits res.users

Security warnings

Migration considerations