From 1f8d14f8e1001bd21abcff89543fd167516d70d7 Mon Sep 17 00:00:00 2001 From: Achraf Date: Mon, 15 May 2023 11:16:53 +0000 Subject: [PATCH] [FIX] mass_mailing_*: Improve error handling for missing redirect URL Handling of 'None' return value from 'get_url_from_code' to prevent crashes in 'request.redirect' https://github.com/odoo/odoo/blob/05fc9a67335d5a96752d828defa066d4fdabe301/addons/link_tracker/models/link_tracker.py#L248-L255 Apply same logic as https://github.com/odoo/odoo/blob/c46f4b908a73658ce2aa7fd9987fbac76a0dda00/addons/link_tracker/controller/main.py#L21-L24 sentry-4183731887 closes odoo/odoo#122679 X-original-commit: d41684023c3845659ed2d96dd235128f4a12bdae Signed-off-by: Achraf (abz) Signed-off-by: Thibault Delavallee (tde) --- addons/mass_mailing/controllers/main.py | 12 +++++++----- addons/mass_mailing_sms/controllers/main.py | 7 ++++++- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/addons/mass_mailing/controllers/main.py b/addons/mass_mailing/controllers/main.py index dbf721d45cc..95f86f82a57 100644 --- a/addons/mass_mailing/controllers/main.py +++ b/addons/mass_mailing/controllers/main.py @@ -2,7 +2,6 @@ # Part of Odoo. See LICENSE file for full copyright and licensing details. import base64 -import werkzeug from odoo import _, exceptions, http, tools from odoo.http import request, Response @@ -109,7 +108,7 @@ class MassMailController(http.Controller): @http.route(['/unsubscribe_from_list'], type='http', website=True, multilang=False, auth='public', sitemap=False) def mailing_unsubscribe_placeholder_link(self, **post): """Dummy route so placeholder is not prefixed by language, MUST have multilang=False""" - raise werkzeug.exceptions.NotFound() + raise NotFound() # ------------------------------------------------------------ # TRACKING @@ -137,7 +136,10 @@ class MassMailController(http.Controller): country_code=request.geoip.country_code, mailing_trace_id=mailing_trace_id ) - return request.redirect(request.env['link.tracker'].get_url_from_code(code), code=301, local=False) + redirect_url = request.env['link.tracker'].get_url_from_code(code) + if not redirect_url: + raise NotFound() + return request.redirect(redirect_url, code=301, local=False) # ------------------------------------------------------------ # MAILING MANAGEMENT @@ -146,7 +148,7 @@ class MassMailController(http.Controller): @http.route('/mailing/report/unsubscribe', type='http', website=True, auth='public') def mailing_report_deactivate(self, token, user_id): if not token or not user_id: - raise werkzeug.exceptions.NotFound() + raise NotFound() user_id = int(user_id) correct_token = consteq(token, request.env['mailing.mailing']._generate_mailing_report_token(user_id)) user = request.env['res.users'].sudo().browse(user_id) @@ -156,7 +158,7 @@ class MassMailController(http.Controller): menu_id = request.env.ref('mass_mailing.menu_mass_mailing_global_settings').id return request.render('mass_mailing.mailing_report_deactivated', {'menu_id': menu_id}) return request.render('mass_mailing.mailing_report_deactivated') - raise werkzeug.exceptions.NotFound() + raise NotFound() @http.route(['/mailing//view'], type='http', website=True, auth='public') def mailing_view_in_browser(self, mailing_id, email=None, res_id=None, token=""): diff --git a/addons/mass_mailing_sms/controllers/main.py b/addons/mass_mailing_sms/controllers/main.py index 455569aaa84..4ac1d7a0ea5 100644 --- a/addons/mass_mailing_sms/controllers/main.py +++ b/addons/mass_mailing_sms/controllers/main.py @@ -1,6 +1,8 @@ # -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. +from werkzeug.exceptions import NotFound + from odoo import http, _ from odoo.addons.phone_validation.tools import phone_validation from odoo.http import request @@ -96,4 +98,7 @@ class MailingSMSController(http.Controller): country_code=request.geoip.country_code, mailing_trace_id=trace_id ) - return request.redirect(request.env['link.tracker'].get_url_from_code(code), code=301, local=False) + redirect_url = request.env['link.tracker'].get_url_from_code(code) + if not redirect_url: + raise NotFound() + return request.redirect(redirect_url, code=301, local=False)