Daily updates from Odoo
Friday, September 26, 2025
1 change · 18.0
Security fixes and vulnerability patches
Publicly shared MP4 files in Documents will no longer show a preview option to visitors using an anonymous link. This prevents hosted videos from being streamed through public document previews and better protects shared content access expectations.
Original PR description
**Issue:** When sharing an MP4 video with "Anyone with the link" viewer access, the video is available to preview without login. **Steps to reproduce:** 1. Install documents 2. Upload an MP4 video 3. Share it with the smart button with anyone with the link viewer access 4. Copy link and paste it in incognito in chrome **Result:** - Video preview option is available **Cause:** - The method get_previewable_file_extensions allows 'mp4' videos to be previewed. **Solution:** - Remove the 'mp4' extension from the previewable list. **NOTE:** - We do not want to be 'used' as a video streaming platform. We do not do it for our own eLearning videos, so we can't do it here, Preview file should simply not be publically available for videos we host. opw-4926384