From 3cbc0915bb6243aceb794810af11d8cfee291ba9 Mon Sep 17 00:00:00 2001
From: Olivier Dony <odo@odoo.com>
Date: Sat, 2 Oct 2021 15:04:53 +0200
Subject: [PATCH] [FIX] web: expect explicit sign up parameters

Using an explicit list of sign up parameters will avoid
polluting the context with unrelated values, and make
debugging easier.
---
 addons/auth_signup/controllers/main.py | 4 ++--
 addons/web/controllers/main.py         | 6 +++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/addons/auth_signup/controllers/main.py b/addons/auth_signup/controllers/main.py
index 2dad902398f..803f107018b 100644
--- a/addons/auth_signup/controllers/main.py
+++ b/addons/auth_signup/controllers/main.py
@@ -5,7 +5,7 @@ import werkzeug
 
 from odoo import http, _
 from odoo.addons.auth_signup.models.res_users import SignupError
-from odoo.addons.web.controllers.main import ensure_db, Home
+from odoo.addons.web.controllers.main import ensure_db, Home, SIGN_UP_REQUEST_PARAMS
 from odoo.addons.base_setup.controllers.main import BaseSetup
 from odoo.exceptions import UserError
 from odoo.http import request
@@ -101,7 +101,7 @@ class AuthSignupHome(Home):
 
     def get_auth_signup_qcontext(self):
         """ Shared helper returning the rendering context for signup and reset password """
-        qcontext = request.params.copy()
+        qcontext = {k: v for (k, v) in request.params.items() if k in SIGN_UP_REQUEST_PARAMS}
         qcontext.update(self.get_auth_signup_config())
         if not qcontext.get('token') and request.session.get('auth_signup_token'):
             qcontext['token'] = request.session.get('auth_signup_token')
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 7aa33c0523e..363ca495d00 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -561,6 +561,10 @@ class HomeStaticTemplateHelpers(object):
     def get_qweb_templates(cls, addons=None, db=None, debug=False, bundle=None):
         return cls(addons, db, debug=debug)._get_qweb_templates(bundle)[0]
 
+# Shared parameters for all login/signup flows
+SIGN_UP_REQUEST_PARAMS = {'db', 'login', 'debug', 'token', 'message', 'error', 'scope', 'mode',
+                          'redirect', 'redirect_hostname', 'email', 'name', 'partner_id',
+                          'password', 'confirm_password', 'city', 'country_id', 'lang'}
 
 class GroupsTreeNode:
     """
@@ -848,7 +852,7 @@ class Home(http.Controller):
         if not request.uid:
             request.uid = odoo.SUPERUSER_ID
 
-        values = request.params.copy()
+        values = {k: v for k, v in request.params.items() if k in SIGN_UP_REQUEST_PARAMS}
         try:
             values['databases'] = http.db_list()
         except odoo.exceptions.AccessDenied: