From 114f09ba983ef3d275bb33c2410d8991faace22b Mon Sep 17 00:00:00 2001 From: Archana Vaghasiya Date: Tue, 8 Aug 2023 18:24:50 +0530 Subject: [PATCH] [FIX] microsoft_account: raise the Badrequest if the post data doesn't available [FIX] microsoft_account: accessing the url without any post data When a user tries to access the URL directly, at that time the value of dictionary `kw` is not available. So the error will be generated. Error : KeyError: `state` This commit will solve the above issue by raising the `BadRequest` if the value of dictionary `kw` does not available. sentry-4377121133 closes odoo/odoo#157720 X-original-commit: 382b64c2f14073cfff1a8ef9290b5c7834d52188 Signed-off-by: Thibault Delavallee (tde) --- addons/microsoft_account/controllers/main.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/addons/microsoft_account/controllers/main.py b/addons/microsoft_account/controllers/main.py index 63aa82bf937..8326427ccf7 100644 --- a/addons/microsoft_account/controllers/main.py +++ b/addons/microsoft_account/controllers/main.py @@ -2,6 +2,7 @@ # Part of Odoo. See LICENSE file for full copyright and licensing details. import json +from werkzeug.exceptions import BadRequest from odoo import http from odoo.http import request @@ -12,10 +13,11 @@ class MicrosoftAuth(http.Controller): @http.route('/microsoft_account/authentication', type='http', auth="public") def oauth2callback(self, **kw): """ This route/function is called by Microsoft when user Accept/Refuse the consent of Microsoft """ - state = json.loads(kw['state']) - dbname = state.get('d') + state = json.loads(kw.get('state', '{}')) service = state.get('s') url_return = state.get('f') + if (not service or (kw.get('code') and not url_return)): + raise BadRequest() if kw.get('code'): access_token, refresh_token, ttl = request.env['microsoft.service']._get_microsoft_tokens(kw['code'], service)