Odoo Changelog — 2025-09-29

Monday, September 29, 2025

2 changes · 19.0

Security(1)

Security fixes and vulnerability patches

[FIX] documents: do not allow preview if video mimetype file

Enterprise19.0documentsSECURITY

Shared MP4 videos in Documents can no longer be previewed by anyone with only a public link. This reduces unintended public viewing and helps prevent the system from being used as a video streaming service.

Original PR description

**Issue:** When sharing an MP4 video with "Anyone with the link" viewer access,
the video is available to preview without login.

**Steps to reproduce:**

1. Install documents
2. Upload an MP4 video
3. Share it with the smart button with anyone with the link viewer access
4. Copy link and paste it in incognito in chrome

**Result:**
- Video preview option is available

**Cause:**
- The method get_previewable_file_extensions allows 'mp4' videos to be previewed.

**Solution:**
- Remove the 'mp4' extension from the previewable list.

**NOTE:** 
- We do not want to be 'used' as a video streaming platform.
We do not do it for our own eLearning videos, so we can't do it here,
Preview file should simply not be publically available for videos we host.

opw-4926384

Forward-Port-Of: odoo/enterprise#90158

#video#sharing#preview#public access

Bug Fixes(1)

Resolved issues and error corrections

[FIX] project: prevent project users from creating stages in list view

PR #228995

Core19.0projectSECURITY

Project users can no longer create new task stages from the task list when they do not have the right permissions. This keeps project workflows controlled by project managers and prevents accidental or unauthorized changes to task stages.

Original PR description

Steps to reproduce:
- Go to a project
- Open the task list view
- Select a task
- In the `Stage` field, attempt to create a new stage

Issue:
- Project users were able to create new task stages from the task list view, despite not having the required permissions.

Cause:
- The `_default_user_id` method assigns the current user as the owner `user_id` of a new stage only when `default_project_id` is not present in the context. As a result, the method returned the current user’s ID, unintentionally making them the owner of the stage. This allowed project users to bypass the intended access rules and create new stages.

Solution:
- Use the `no_create` option for users outside the project manager group to prevent them from creating new stages.
- Updated the `stage_id` field in the task list view to explicitly include `default_project_id` in the context, ensuring proper access control of that stage.

task-4628666

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#228907
Forward-Port-Of: odoo/odoo#206407

#permissions#project#tasks#access-control

**Issue:** When sharing an MP4 video with "Anyone with the link" viewer access, the video is available to preview without login. **Steps to reproduce:** 1. Install documents 2. Upload an MP4 video 3. Share it with the smart button with anyone with the link viewer access 4. Copy link and paste it in incognito in chrome **Result:** - Video preview option is available **Cause:** - The method get_previewable_file_extensions allows 'mp4' videos to be previewed. **Solution:** - Remove the 'mp4' extension from the previewable list. **NOTE:** - We do not want to be 'used' as a video streaming platform. We do not do it for our own eLearning videos, so we can't do it here, Preview file should simply not be publically available for videos we host. opw-4926384 Forward-Port-Of: odoo/enterprise#90158

Steps to reproduce: - Go to a project - Open the task list view - Select a task - In the `Stage` field, attempt to create a new stage Issue: - Project users were able to create new task stages from the task list view, despite not having the required permissions. Cause: - The `_default_user_id` method assigns the current user as the owner `user_id` of a new stage only when `default_project_id` is not present in the context. As a result, the method returned the current user’s ID, unintentionally making them the owner of the stage. This allowed project users to bypass the intended access rules and create new stages. Solution: - Use the `no_create` option for users outside the project manager group to prevent them from creating new stages. - Updated the `stage_id` field in the task list view to explicitly include `default_project_id` in the context, ensuring proper access control of that stage. task-4628666 --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr Forward-Port-Of: odoo/odoo#228907 Forward-Port-Of: odoo/odoo#206407