Odoo Changelog — 2025-09-26

Friday, September 26, 2025

2 changes · 18.0

Security(1)

Security fixes and vulnerability patches

[FIX] documents: do not allow preview if video mimetype file

Enterprise18.0documentsSecurity

Publicly shared MP4 files in Documents will no longer show a preview option to visitors using an anonymous link. This prevents hosted videos from being streamed through public document previews and better protects shared content access expectations.

Original PR description

**Issue:** When sharing an MP4 video with "Anyone with the link" viewer access,
the video is available to preview without login.

**Steps to reproduce:**

1. Install documents
2. Upload an MP4 video
3. Share it with the smart button with anyone with the link viewer access
4. Copy link and paste it in incognito in chrome

**Result:**
- Video preview option is available

**Cause:**
- The method get_previewable_file_extensions allows 'mp4' videos to be previewed.

**Solution:**
- Remove the 'mp4' extension from the previewable list.

**NOTE:** 
- We do not want to be 'used' as a video streaming platform.
We do not do it for our own eLearning videos, so we can't do it here,
Preview file should simply not be publically available for videos we host.

opw-4926384

#documents#video#sharing#preview

Bug Fixes(1)

Resolved issues and error corrections

[FIX] project: prevent project users from creating stages in list view

PR #228627

Core18.0projectSecurity

Project users can no longer create new task stages from the task list when they do not have the required permissions. This prevents accidental or unauthorized workflow changes and keeps project stage management limited to project managers.

Original PR description

Steps to reproduce:
- Go to a project
- Open the task list view
- Select a task
- In the `Stage` field, attempt to create a new stage

Issue:
- Project users were able to create new task stages from the task list view, despite not having the required permissions.

Cause:
- The `_default_user_id` method assigns the current user as the owner `user_id` of a new stage only when `default_project_id` is not present in the context. As a result, the method returned the current user’s ID, unintentionally making them the owner of the stage. This allowed project users to bypass the intended access rules and create new stages.

Solution:
- Use the `no_create` option for users outside the project manager group to prevent them from creating new stages.
- Updated the `stage_id` field in the task list view to explicitly include `default_project_id` in the context, ensuring proper access control of that stage.

task-4628666

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#206407

**Issue:** When sharing an MP4 video with "Anyone with the link" viewer access, the video is available to preview without login. **Steps to reproduce:** 1. Install documents 2. Upload an MP4 video 3. Share it with the smart button with anyone with the link viewer access 4. Copy link and paste it in incognito in chrome **Result:** - Video preview option is available **Cause:** - The method get_previewable_file_extensions allows 'mp4' videos to be previewed. **Solution:** - Remove the 'mp4' extension from the previewable list. **NOTE:** - We do not want to be 'used' as a video streaming platform. We do not do it for our own eLearning videos, so we can't do it here, Preview file should simply not be publically available for videos we host. opw-4926384

Steps to reproduce: - Go to a project - Open the task list view - Select a task - In the `Stage` field, attempt to create a new stage Issue: - Project users were able to create new task stages from the task list view, despite not having the required permissions. Cause: - The `_default_user_id` method assigns the current user as the owner `user_id` of a new stage only when `default_project_id` is not present in the context. As a result, the method returned the current user’s ID, unintentionally making them the owner of the stage. This allowed project users to bypass the intended access rules and create new stages. Solution: - Use the `no_create` option for users outside the project manager group to prevent them from creating new stages. - Updated the `stage_id` field in the task list view to explicitly include `default_project_id` in the context, ensuring proper access control of that stage. task-4628666 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#206407