brain-tec · bt-admin · Jun 12, 2026 · May 21, 2026 · May 21, 2026 · May 21, 2026
diff --git a/README.md b/README.md
@@ -38,13 +38,13 @@ addon | version | maintainers | summary
 [storage_backend_ftp](storage_backend_ftp/) | 18.0.1.0.0 |  | Implement FTP Storage
 [storage_backend_s3](storage_backend_s3/) | 18.0.1.1.0 |  | Implement amazon S3 Storage
 [storage_backend_sftp](storage_backend_sftp/) | 18.0.1.0.0 |  | Implement SFTP Storage
-[storage_file](storage_file/) | 18.0.1.1.0 |  | Storage file in storage backend
+[storage_file](storage_file/) | 18.0.1.2.0 |  | Storage file in storage backend
 [storage_file_swap_backend_queue](storage_file_swap_backend_queue/) | 18.0.1.1.0 | <a href='https://github.com/simahawk'><img src='https://github.com/simahawk.png' width='32' height='32' style='border-radius:50%;' alt='simahawk'/></a> | Delegate storage file backend swap to queue jobs
-[storage_image](storage_image/) | 18.0.1.1.0 |  | Store image and resized image in a storage backend
-[storage_image_product](storage_image_product/) | 18.0.1.0.2 |  | Link images to products and categories
-[storage_media](storage_media/) | 18.0.1.2.0 |  | Give the posibility to store media data in Odoo
-[storage_media_product](storage_media_product/) | 18.0.1.0.1 |  | Link media to products and categories
-[storage_thumbnail](storage_thumbnail/) | 18.0.1.0.0 |  | Abstract module that add the possibility to have thumbnail
+[storage_image](storage_image/) | 18.0.1.2.0 |  | Store image and resized image in a storage backend
+[storage_image_product](storage_image_product/) | 18.0.1.1.0 |  | Link images to products and categories
+[storage_media](storage_media/) | 18.0.1.3.0 |  | Give the posibility to store media data in Odoo
+[storage_media_product](storage_media_product/) | 18.0.1.1.0 |  | Link media to products and categories
+[storage_thumbnail](storage_thumbnail/) | 18.0.1.1.0 |  | Abstract module that add the possibility to have thumbnail
 
 [//]: # (end addons)
 

diff --git a/checklog-odoo.cfg b/checklog-odoo.cfg
@@ -1,3 +1,4 @@
 [checklog-odoo]
 ignore=
     WARNING.* 0 failed, 0 error\(s\).*
+    WARNING.*DeprecationWarning: PyUnicode_FromUnicode\(NULL, size\) is deprecated; use PyUnicode_New\(\) instead
diff --git a/storage_file/README.rst b/storage_file/README.rst
@@ -11,7 +11,7 @@ Storage File
    !! This file is generated by oca-gen-addon-readme !!
    !! changes will be overwritten.                   !!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-   !! source digest: sha256:14eff9ac3e34f90b55e98e5f1d8e938390db9e5d7c2f421d370143c3a26f5e1b
+   !! source digest: sha256:c7ccd99c8428f973c93fbbdde0021b61a5db3077bc2d7722a2f929611f8ac415
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
 .. |badge1| image:: https://img.shields.io/badge/maturity-Production%2FStable-green.png

diff --git a/storage_file/__manifest__.py b/storage_file/__manifest__.py
@@ -5,7 +5,7 @@
 {
     "name": "Storage File",
     "summary": "Storage file in storage backend",
-    "version": "18.0.1.1.0",
+    "version": "18.0.1.2.0",
     "category": "Storage",
     "website": "https://github.com/OCA/storage",
     "author": " Akretion, Odoo Community Association (OCA)",
@@ -23,5 +23,6 @@
         "data/ir_cron.xml",
         "data/storage_backend.xml",
         "wizards/swap_backend.xml",
+        "data/ir_config_parameter.xml",
     ],
 }
diff --git a/storage_file/controllers/main.py b/storage_file/controllers/main.py
@@ -1,7 +1,9 @@
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
+from werkzeug.exceptions import NotFound
 
 from odoo import http
+from odoo.exceptions import AccessError
 from odoo.http import request
 
 
@@ -13,6 +15,15 @@ def content_common(self, slug_name_with_id, token=None, download=None, **kw):
         storage_file = request.env["storage.file"].get_from_slug_name_with_id(
             slug_name_with_id
         )
+        if not storage_file.exists():
+            raise NotFound()
+        try:
+            storage_file.check_access("read")
+        except AccessError as err:
+            # If you don't have access you should not know
+            # that the file exists (as anon user).
+            # You can inspect the traceback to see it's coming from an access error.
+            raise NotFound() from err
         stream = request.env["ir.binary"]._get_stream_from(
             storage_file, field_name="data"
         )

diff --git a/storage_file/data/ir_config_parameter.xml b/storage_file/data/ir_config_parameter.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<odoo noupdate="1">
+    <record id="storage_file_backend" model="ir.config_parameter">
+        <field name="key">storage.file.backend_id</field>
+        <field name="value" ref="storage_backend.default_storage_backend" />
+    </record>
+</odoo>
diff --git a/storage_file/i18n/it.po b/storage_file/i18n/it.po
@@ -16,6 +16,17 @@ msgstr ""
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
 "X-Generator: Weblate 5.6.2\n"
 
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_backend_view_form
+msgid ""
+"<strong>Note:</strong> Without a CDN base URL, files will be proxied\n"
+"                    through Odoo. This is acceptable for internal use with "
+"low traffic\n"
+"                    but suboptimal for high-volume public access as every "
+"request loads\n"
+"                    the file from the storage backend into memory."
+msgstr ""
+
 #. module: storage_file
 #. odoo-python
 #: code:addons/storage_file/models/storage_file.py:0
@@ -40,6 +51,11 @@ msgid ""
 "%s"
 msgstr ""
 
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_file_view_search
+msgid "Backend"
+msgstr ""
+
 #. module: storage_file
 #: model:ir.model.fields,field_description:storage_file.field_storage_backend__backend_view_use_internal_url
 msgid "Backend View Use Internal Url"
@@ -206,6 +222,11 @@ msgstr ""
 msgid "Files to swap"
 msgstr ""
 
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_file_view_search
+msgid "Group By"
+msgstr ""
+
 #. module: storage_file
 #: model:ir.model.fields,help:storage_file.field_storage_file__internal_url
 msgid "HTTP URL to load the file directly from storage."
@@ -244,6 +265,7 @@ msgstr "URL interno"
 
 #. module: storage_file
 #: model:ir.model.fields,field_description:storage_file.field_storage_backend__is_public
+#: model:ir.model.fields,field_description:storage_file.field_storage_file__is_public
 msgid "Is Public"
 msgstr "È pubblico"
 
@@ -302,11 +324,26 @@ msgstr ""
 msgid "Please select at least one file."
 msgstr ""
 
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_file_view_search
+msgid "Private"
+msgstr ""
+
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_file_view_search
+msgid "Public"
+msgstr ""
+
 #. module: storage_file
 #: model_terms:ir.ui.view,arch_db:storage_file.storage_backend_view_form
 msgid "Recompute base URL for files"
 msgstr "Ricalcola l'URL base per i file"
 
+#. module: storage_file
+#: model:ir.model.fields,help:storage_file.field_storage_file__is_public
+msgid "Reflects the `is_public` flag of the related backend."
+msgstr ""
+
 #. module: storage_file
 #: model:ir.model.fields,field_description:storage_file.field_storage_file__relative_path
 msgid "Relative Path"

diff --git a/storage_file/i18n/storage_file.pot b/storage_file/i18n/storage_file.pot
@@ -13,6 +13,15 @@ msgstr ""
 "Content-Transfer-Encoding: \n"
 "Plural-Forms: \n"
 
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_backend_view_form
+msgid ""
+"<strong>Note:</strong> Without a CDN base URL, files will be proxied\n"
+"                    through Odoo. This is acceptable for internal use with low traffic\n"
+"                    but suboptimal for high-volume public access as every request loads\n"
+"                    the file from the storage backend into memory."
+msgstr ""
+
 #. module: storage_file
 #. odoo-python
 #: code:addons/storage_file/models/storage_file.py:0
@@ -37,6 +46,11 @@ msgid ""
 "%s"
 msgstr ""
 
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_file_view_search
+msgid "Backend"
+msgstr ""
+
 #. module: storage_file
 #: model:ir.model.fields,field_description:storage_file.field_storage_backend__backend_view_use_internal_url
 msgid "Backend View Use Internal Url"
@@ -192,6 +206,11 @@ msgstr ""
 msgid "Files to swap"
 msgstr ""
 
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_file_view_search
+msgid "Group By"
+msgstr ""
+
 #. module: storage_file
 #: model:ir.model.fields,help:storage_file.field_storage_file__internal_url
 msgid "HTTP URL to load the file directly from storage."
@@ -228,6 +247,7 @@ msgstr ""
 
 #. module: storage_file
 #: model:ir.model.fields,field_description:storage_file.field_storage_backend__is_public
+#: model:ir.model.fields,field_description:storage_file.field_storage_file__is_public
 msgid "Is Public"
 msgstr ""
 
@@ -284,11 +304,26 @@ msgstr ""
 msgid "Please select at least one file."
 msgstr ""
 
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_file_view_search
+msgid "Private"
+msgstr ""
+
+#. module: storage_file
+#: model_terms:ir.ui.view,arch_db:storage_file.storage_file_view_search
+msgid "Public"
+msgstr ""
+
 #. module: storage_file
 #: model_terms:ir.ui.view,arch_db:storage_file.storage_backend_view_form
 msgid "Recompute base URL for files"
 msgstr ""
 
+#. module: storage_file
+#: model:ir.model.fields,help:storage_file.field_storage_file__is_public
+msgid "Reflects the `is_public` flag of the related backend."
+msgstr ""
+
 #. module: storage_file
 #: model:ir.model.fields,field_description:storage_file.field_storage_file__relative_path
 msgid "Relative Path"

diff --git a/storage_file/models/storage_backend.py b/storage_file/models/storage_backend.py
@@ -145,7 +145,10 @@ def _get_base_url_from_param(self):
     def _get_url_for_file(self, storage_file, exclude_base_url=False):
         """Return final full URL for given file."""
         backend = self.sudo()
-        if backend.served_by == "odoo":
+        # Make sure that no matter if you have a CDN URL or not,
+        # you can always access the file via Odoo.
+        force_serve_via_odoo = backend.served_by == "external" and not backend.base_url
+        if backend.served_by == "odoo" or force_serve_via_odoo:
             parts = [
                 self._get_base_url_from_param() if not exclude_base_url else "/",
                 "storage.file",

diff --git a/storage_file/models/storage_file.py b/storage_file/models/storage_file.py
@@ -30,7 +30,11 @@ class StorageFile(models.Model):
 
     name = fields.Char(required=True, index=True)
     backend_id = fields.Many2one(
-        "storage.backend", "Storage", index=True, required=True
+        "storage.backend",
+        "Storage",
+        index=True,
+        required=True,
+        default=lambda self: self._get_default_backend_id(),
     )
     url = fields.Char(compute="_compute_url", help="HTTP accessible path to the file")
     url_path = fields.Char(
@@ -65,6 +69,33 @@ class StorageFile(models.Model):
         "res.company", "Company", default=lambda self: self.env.user.company_id.id
     )
     file_type = fields.Selection([])
+    is_public = fields.Boolean(
+        compute="_compute_is_public",
+        compute_sudo=True,
+        search="_search_is_public",
+        # Not stored to avoid massive recomputes when the backend flag changes.
+        help="Reflects the `is_public` flag of the related backend.",
+    )
+
+    @api.depends("backend_id.is_public")
+    def _compute_is_public(self):
+        for rec in self:
+            rec.is_public = rec.backend_id.is_public
+
+    @api.model
+    def _get_default_backend_id(self):
+        return self.env["storage.backend"]._get_backend_id_from_param(
+            self.env, "storage.file.backend_id"
+        )
+
+    def _search_is_public(self, operator, value):
+        # Look up matching backends with sudo so that users with limited ACL
+        # on `storage.backend` can still filter their accessible files by
+        # public flag.
+        backends = (
+            self.env["storage.backend"].sudo().search([("is_public", operator, value)])
+        )
+        return [("backend_id", "in", backends.ids)]
 
     _sql_constraints = [
         (
@@ -175,6 +206,8 @@ def _get_url(self, exclude_base_url=False):
 
         :param exclude_base_url: skip base_url
         """
+        if not self.backend_id or not self.relative_path:
+            return ""
         return self.backend_id._get_url_for_file(
             self, exclude_base_url=exclude_base_url
         )

diff --git a/storage_file/security/ir.model.access.csv b/storage_file/security/ir.model.access.csv
@@ -1,5 +1,6 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_storage_file_edit,storage_file edit,model_storage_file,base.group_system,1,1,1,1
 access_storage_file_read_public,storage_file public read,model_storage_file,base.group_user,1,0,0,0
+access_storage_file_read_portal,storage_file portal read,model_storage_file,base.group_public,1,0,0,0
 access_storage_file_replace,storage_file_replace public,model_storage_file_replace,base.group_user,1,1,1,1
 access_storage_file_swap_backend,storage_file_swap_backend admin,model_storage_file_swap_backend,base.group_system,1,1,1,1
diff --git a/storage_file/security/storage_file.xml b/storage_file/security/storage_file.xml
@@ -13,4 +13,15 @@
         <field name="perm_create" eval="False" />
         <field name="perm_unlink" eval="False" />
     </record>
+    <!--Internal users can read all files (public and private)-->
+    <record id="ir_rule_storage_file_internal" model="ir.rule">
+        <field name="name">Storage file internal read all</field>
+        <field name="model_id" ref="model_storage_file" />
+        <field name="groups" eval="[(4, ref('base.group_user'))]" />
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="perm_read" eval="True" />
+        <field name="perm_write" eval="False" />
+        <field name="perm_create" eval="False" />
+        <field name="perm_unlink" eval="False" />
+    </record>
 </odoo>
diff --git a/storage_file/static/description/index.html b/storage_file/static/description/index.html
@@ -372,7 +372,7 @@ <h1>Storage File</h1>
 !! This file is generated by oca-gen-addon-readme !!
 !! changes will be overwritten.                   !!
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-!! source digest: sha256:14eff9ac3e34f90b55e98e5f1d8e938390db9e5d7c2f421d370143c3a26f5e1b
+!! source digest: sha256:c7ccd99c8428f973c93fbbdde0021b61a5db3077bc2d7722a2f929611f8ac415
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -->
 <p><a class="reference external image-reference" href="https://odoo-community.org/page/development-status"><img alt="Production/Stable" src="https://img.shields.io/badge/maturity-Production%2FStable-green.png" /></a> <a class="reference external image-reference" href="http://www.gnu.org/licenses/lgpl-3.0-standalone.html"><img alt="License: LGPL-3" src="https://img.shields.io/badge/license-LGPL--3-blue.png" /></a> <a class="reference external image-reference" href="https://github.com/OCA/storage/tree/18.0/storage_file"><img alt="OCA/storage" src="https://img.shields.io/badge/github-OCA%2Fstorage-lightgray.png?logo=github" /></a> <a class="reference external image-reference" href="https://translation.odoo-community.org/projects/storage-18-0/storage-18-0-storage_file"><img alt="Translate me on Weblate" src="https://img.shields.io/badge/weblate-Translate%20me-F47D42.png" /></a> <a class="reference external image-reference" href="https://runboat.odoo-community.org/builds?repo=OCA/storage&amp;target_branch=18.0"><img alt="Try me on Runboat" src="https://img.shields.io/badge/runboat-Try%20me-875A7B.png" /></a></p>
 <p>External file management depending on Storage Backend module.</p>

diff --git a/storage_file/tests/__init__.py b/storage_file/tests/__init__.py
@@ -1,2 +1,4 @@
 from . import test_storage_file
 from . import test_swap_backend
+from . import test_is_public
+from . import test_controller