Daily updates from Odoo
Monday, September 29, 2025
1 change · 19.0
Security fixes and vulnerability patches
Shared MP4 videos in Documents can no longer be previewed by anyone with only a public link. This reduces unintended public viewing and helps prevent the system from being used as a video streaming service.
Original PR description
**Issue:** When sharing an MP4 video with "Anyone with the link" viewer access, the video is available to preview without login. **Steps to reproduce:** 1. Install documents 2. Upload an MP4 video 3. Share it with the smart button with anyone with the link viewer access 4. Copy link and paste it in incognito in chrome **Result:** - Video preview option is available **Cause:** - The method get_previewable_file_extensions allows 'mp4' videos to be previewed. **Solution:** - Remove the 'mp4' extension from the previewable list. **NOTE:** - We do not want to be 'used' as a video streaming platform. We do not do it for our own eLearning videos, so we can't do it here, Preview file should simply not be publically available for videos we host. opw-4926384 Forward-Port-Of: odoo/enterprise#90158