From 52a204f3dad3723c4dd8b948f241518dbbae20d5 Mon Sep 17 00:00:00 2001
From: Om Rabara <omra@odoo.com>
Date: Mon, 3 Jul 2023 13:31:27 +0000
Subject: [PATCH] [FIX] base: handle database.secret parameter while deletion

An error occurs when the user attempts to delete the 'database.secret' record,
either by following these steps:
- Enable developer mode.
- Go to Settings > Technical > System Parameters.
- Select the 'database.secret' record and attempt to delete it.

Or when the user tries to update the key for the 'database.secret' record using
the following steps:
- Open the 'database.secret' record.
- Update the value of the key field.
-  Save the record.
- The server will stop running and not be accessible.

Error: ValueError: CSRF protection requires a configured database secret

sentry - 4291267997

closes odoo/odoo#131460

X-original-commit: fe694e5b8285ceed99b321c22af534eee25cf282
Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
---
 odoo/addons/base/i18n/base.pot                | 14 +++++++++++++
 .../addons/base/models/ir_config_parameter.py | 12 ++++++++++-
 odoo/addons/base/tests/__init__.py            |  1 +
 .../base/tests/test_config_parameter.py       | 21 +++++++++++++++++++
 4 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 odoo/addons/base/tests/test_config_parameter.py

diff --git a/odoo/addons/base/i18n/base.pot b/odoo/addons/base/i18n/base.pot
index bf0ed24c757..a172bfc9f3c 100644
--- a/odoo/addons/base/i18n/base.pot
+++ b/odoo/addons/base/i18n/base.pot
@@ -31119,6 +31119,13 @@ msgid ""
 "Linked active users : %(names)s"
 msgstr ""
 
+#. module: base
+#. odoo-python
+#: code:addons/base/models/ir_config_parameter.py:0
+#, python-format
+msgid "You cannot delete the %s record."
+msgstr ""
+
 #. module: base
 #. odoo-python
 #: code:addons/base/models/res_lang.py:0
@@ -31149,6 +31156,13 @@ msgid ""
 " an accounting entry."
 msgstr ""
 
+#. module: base
+#. odoo-python
+#: code:addons/base/models/ir_config_parameter.py:0
+#, python-format
+msgid "You cannot rename config parameters with keys %s"
+msgstr ""
+
 #. module: base
 #. odoo-python
 #: code:addons/models.py:0
diff --git a/odoo/addons/base/models/ir_config_parameter.py b/odoo/addons/base/models/ir_config_parameter.py
index a5654a99296..3c0ef7dd6a0 100644
--- a/odoo/addons/base/models/ir_config_parameter.py
+++ b/odoo/addons/base/models/ir_config_parameter.py
@@ -7,7 +7,8 @@ Store database-specific configuration parameters
 import uuid
 import logging
 
-from odoo import api, fields, models
+from odoo import api, fields, models, _
+from odoo.exceptions import ValidationError
 from odoo.tools import config, ormcache, mute_logger
 
 _logger = logging.getLogger(__name__)
@@ -106,9 +107,18 @@ class IrConfigParameter(models.Model):
         return super(IrConfigParameter, self).create(vals_list)
 
     def write(self, vals):
+        if 'key' in vals:
+            illegal = _default_parameters.keys() & self.mapped('key')
+            if illegal:
+                raise ValidationError(_("You cannot rename config parameters with keys %s", ', '.join(illegal)))
         self.env.registry.clear_cache()
         return super(IrConfigParameter, self).write(vals)
 
     def unlink(self):
         self.env.registry.clear_cache()
         return super(IrConfigParameter, self).unlink()
+
+    @api.ondelete(at_uninstall=False)
+    def unlink_default_parameters(self):
+        for record in self.filtered(lambda p: p.key in _default_parameters.keys()):
+            raise ValidationError(_("You cannot delete the %s record.", record.key))
diff --git a/odoo/addons/base/tests/__init__.py b/odoo/addons/base/tests/__init__.py
index ee39940dedf..3b4ea5cd30c 100644
--- a/odoo/addons/base/tests/__init__.py
+++ b/odoo/addons/base/tests/__init__.py
@@ -60,3 +60,4 @@ from . import test_cloc
 from . import test_profiler
 from . import test_pdf
 from . import test_neutralize
+from . import test_config_parameter
diff --git a/odoo/addons/base/tests/test_config_parameter.py b/odoo/addons/base/tests/test_config_parameter.py
new file mode 100644
index 00000000000..fde5d7f9c97
--- /dev/null
+++ b/odoo/addons/base/tests/test_config_parameter.py
@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo.addons.base.models.ir_config_parameter import _default_parameters
+from odoo.exceptions import ValidationError
+from odoo.tests.common import TransactionCase
+
+
+class TestIrConfigParameter(TransactionCase):
+
+    def test_default_parameters(self):
+        """ Check the behavior of _default_parameters
+        when updating keys and deleting records. """
+        for key in _default_parameters:
+            config_parameter = self.env['ir.config_parameter'].search([('key', '=', key)], limit=1)
+            with self.assertRaises(ValidationError):
+                config_parameter.unlink()
+
+            new_key = f"{key}_updated"
+            with self.assertRaises(ValidationError):
+                config_parameter.write({'key': new_key})