Monday, September 29, 2025
1 change · saas-18.2
Security fixes and vulnerability patches
Shared MP4 video files in Documents can no longer be previewed by anyone with a public link. This prevents Odoo-hosted videos from being accessed like a streaming service and better protects shared video content.
Original PR description
**Issue:** When sharing an MP4 video with "Anyone with the link" viewer access, the video is available to preview without login. **Steps to reproduce:** 1. Install documents 2. Upload an MP4 video 3. Share it with the smart button with anyone with the link viewer access 4. Copy link and paste it in incognito in chrome **Result:** - Video preview option is available **Cause:** - The method get_previewable_file_extensions allows 'mp4' videos to be previewed. **Solution:** - Remove the 'mp4' extension from the previewable list. **NOTE:** - We do not want to be 'used' as a video streaming platform. We do not do it for our own eLearning videos, so we can't do it here, Preview file should simply not be publically available for videos we host. opw-4926384 Forward-Port-Of: odoo/enterprise#90158