Security
What Avaya IP Office SMDR Connector can read and write, what it stores, and what leaves your instance.
The webhook
One endpoint per company, authenticated by a bearer token.
- 32 random bytes, generated by the module.
- Stored on a field restricted to Avaya Technical Administrator and masked everywhere in the interface.
- Compared in constant time, so a timing measurement cannot recover it a byte at a time.
- Rotation with a grace period — the previous token keeps working while you restart the listener, then expires on its own.
A wrong token and a blocked IP look identical
Both return 401. A probe cannot tell whether it guessed the token wrong or is simply calling from an address that is not allowed, which denies it the feedback it needs to make progress.
Before the body is read
Payload size is checked from Content-Length before the body is read into memory. Reading a body in order to discover it is too large is a denial of service waiting to happen.
Also on the endpoint: an IP allowlist, a per-minute rate limit, and a cap on batch size.
No dialled number is ever logged
At any log level, in the module or the listener. Phone numbers are personal data and a number in a server log is a number in every backup of that log, on the screen of everyone with shell access, and in whatever aggregates the logs.
The raw SMDR record is stored — in the database, where record rules and group restrictions apply, and visible only to a Technical Administrator.
Party names are escaped
Caller and called party names arrive from the PBX, which means they arrive from outside. Chatter entries are rendered through QWeb, so those names are escaped rather than trusted as HTML. A caller cannot inject markup into your chatter by choosing their name carefully.
Duplicate prevention is a constraint, not logic
Uniqueness is enforced by a database constraint. The listener retries by design — that is what makes the spool durable — so repeats are routine rather than exceptional, and application logic that has to remember to check is logic that eventually does not.
The three groups
| Group | Can |
|---|---|
| Avaya Call User | See their own calls |
| Avaya Call Manager | See all calls, map extensions, reprocess |
| Avaya Technical Administrator | Tokens, allowlists, raw records, retention |
The split that matters is the third. A sales manager needs the call history; a sales manager does not need the webhook credentials or every dialled number in the raw record.
Multi-company
Calls, extensions, endpoints and the request log all carry company record rules. Each company has its own endpoint and its own token.
Retention
Archiving and deletion are both off by default, and deletion stays off until somebody chooses it. A call log is evidence — of a complaint, of a commitment — and something that destroys evidence on a timer should never be a default.
The request log has its own 30-day window, because an audit trail of authentication attempts is worth keeping for a while and worth not keeping forever.
Transport
- Put Odoo behind HTTPS. The token travels on every post.
- The listener has no built-in TLS. If it is not on a trusted network with the PBX, tunnel the SMDR connection. SMDR itself is plaintext; that is the protocol, not a choice this module made.
Reporting a vulnerability
info@technovision.dev. We acknowledge within two business days and keep you informed until it is resolved.