Security model

What Product Barcode & Label Printing can read and write, what it stores, and what leaves your instance.

This module reads product data and produces a PDF. It writes nothing except the label templates themselves, and it makes no network calls.

Groups

The split exists because printing is an everyday job and changing a layout is not. A template edited by someone at the label printer changes the output for everybody, including the sheets already loaded in somebody else's tray.

Ordinary users need read on templates in order to pick one, and full rights on the two transient wizard models, which hold nothing but the current print job and vanish with it.

What the module touches

• Reads product.product and product.pricelist to fill labels in.
• Creates and updates report.paperformat records, but only ones it names itself (Labels: <template name>), and only for roll templates that need a page the size of the label.
• Overrides ir.actions.report.get_paperformat(). The override returns super() unchanged unless the current render is one of this module's own label runs, identified by a context key this module sets. Every other report in Odoo is unaffected, and there is a test asserting exactly that.

Nothing else in the database is written.

Printing limits

A single run is capped at 5,000 labels. That is a guard against a typo in a quantity field, not a licence limit: a mistyped quantity would otherwise produce a PDF that takes minutes to render and a great deal of memory. Split a genuinely larger job across runs.

Barcodes

Barcode images are produced by Odoo's own barcode controller, in-process. No image is fetched from any external service, and no product data leaves the server.

The automatic symbology check is a safety feature as much as a convenience: it refuses to hand a non-EAN-13 value to the EAN-13 renderer, which would produce a blank image on every label with no error anywhere.

Data in the PDF

A label carries whatever the template says: product name, reference, variant values, price, company name, barcode. Nothing else, and nothing from other records.

If you print price labels, remember that the PDF contains your pricing. It is an ordinary Odoo attachment-free report - it is not stored - but it will sit in the browser's downloads folder like any other.

Reporting a vulnerability

Email info@technovision.dev. Please do not open a public issue.