Before this commit the tokens from payment providers (PayPal, Stripe) are shown in plain text in the onboarding wizard.
This means that anyone with accounting rights can grab & copy tokens for PayPal & Stripe.
After this commit they're shielded off with a password=True option so they're not directly readable and copyable.
Steps to reproduce: Open an Odoo instance, go to Accounting > Invoices and click on the 'Set Payments' option for the onboarding wizard.
Next choose Paypal or Credit card in the dialog and see how tokens are shown in plain-text.
closesodoo/odoo#54861
X-original-commit: 65e201ecee3bc145c2ae76d59b6d2fd31c737872
Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
root
98b0f01fc5