[FIX] web: crash when multiple occurrences of cids in url

This error occurs for instance when your session expires and you
reload. At this point, the hash part of the url is duplicated and
an error is raised when the webclient tries to parse 'cids' part.

The hash part of the url should not be duplicated, but whatever the
url hash, the client should not crash either.

This commit prevents the hash part from being duplicated, and the
client from crashing when there are several occurrences of 'cids'.

closes odoo/odoo#52599

Task: 2267401
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>

addons/web/static/src/js/chrome/abstract_web_client.js

@@ -126,7 +126,10 @@ var AbstractWebClient = Widget.extend(KeyboardNavigationMixin, {
         if (!state.cids) {
             state.cids = utils.get_cookie('cids') !== null ? utils.get_cookie('cids') : String(current_company_id);
         }
-        var stateCompanyIDS = _.map(state.cids.split(','), function (cid) { return parseInt(cid) });
+        // If a key appears several times in the hash, it is available in the
+        // bbq state as an array containing all occurrences of that key
+        const cids = Array.isArray(state.cids) ? state.cids[0] : state.cids;
+        let stateCompanyIDS = cids.split(',').map(cid => parseInt(cid, 10));
         var userCompanyIDS = _.map(session.user_companies.allowed_companies, function(company) {return company[0]});
         // Check that the user has access to all the companies
         if (!_.isEmpty(_.difference(stateCompanyIDS, userCompanyIDS))) {

addons/web/views/webclient_templates.xml

@@ -554,7 +554,7 @@
 
     <template id="web.login" name="Login">
         <t t-call="web.login_layout">
-            <form class="oe_login_form" role="form" t-attf-action="/web/login" method="post" onsubmit="this.action = this.action + location.hash">
+            <form class="oe_login_form" role="form" t-attf-action="/web/login" method="post" onsubmit="this.action = '/web/login' + location.hash">
                 <input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
 
                 <div class="form-group field-db" t-if="databases and len(databases) &gt; 1">