From 9e60a82680259cd5125738da21fb9e4b82eabc34 Mon Sep 17 00:00:00 2001
From: Dhruv Patel <dhp@odoo.com>
Date: Mon, 8 Jun 2020 07:26:04 +0000
Subject: [PATCH] [FIX] web: crash when multiple occurrences of cids in url

This error occurs for instance when your session expires and you
reload. At this point, the hash part of the url is duplicated and
an error is raised when the webclient tries to parse 'cids' part.

The hash part of the url should not be duplicated, but whatever the
url hash, the client should not crash either.

This commit prevents the hash part from being duplicated, and the
client from crashing when there are several occurrences of 'cids'.

closes odoo/odoo#52599

Task: 2267401
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
---
 addons/web/static/src/js/chrome/abstract_web_client.js | 5 ++++-
 addons/web/views/webclient_templates.xml               | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/addons/web/static/src/js/chrome/abstract_web_client.js b/addons/web/static/src/js/chrome/abstract_web_client.js
index 95d9868b89a..39da829f209 100644
--- a/addons/web/static/src/js/chrome/abstract_web_client.js
+++ b/addons/web/static/src/js/chrome/abstract_web_client.js
@@ -126,7 +126,10 @@ var AbstractWebClient = Widget.extend(KeyboardNavigationMixin, {
         if (!state.cids) {
             state.cids = utils.get_cookie('cids') !== null ? utils.get_cookie('cids') : String(current_company_id);
         }
-        var stateCompanyIDS = _.map(state.cids.split(','), function (cid) { return parseInt(cid) });
+        // If a key appears several times in the hash, it is available in the
+        // bbq state as an array containing all occurrences of that key
+        const cids = Array.isArray(state.cids) ? state.cids[0] : state.cids;
+        let stateCompanyIDS = cids.split(',').map(cid => parseInt(cid, 10));
         var userCompanyIDS = _.map(session.user_companies.allowed_companies, function(company) {return company[0]});
         // Check that the user has access to all the companies
         if (!_.isEmpty(_.difference(stateCompanyIDS, userCompanyIDS))) {
diff --git a/addons/web/views/webclient_templates.xml b/addons/web/views/webclient_templates.xml
index caa6f06a2c5..4465956061e 100644
--- a/addons/web/views/webclient_templates.xml
+++ b/addons/web/views/webclient_templates.xml
@@ -554,7 +554,7 @@
 
     <template id="web.login" name="Login">
         <t t-call="web.login_layout">
-            <form class="oe_login_form" role="form" t-attf-action="/web/login" method="post" onsubmit="this.action = this.action + location.hash">
+            <form class="oe_login_form" role="form" t-attf-action="/web/login" method="post" onsubmit="this.action = '/web/login' + location.hash">
                 <input type="hidden" name="csrf_token" t-att-value="request.csrf_token()"/>
 
                 <div class="form-group field-db" t-if="databases and len(databases) &gt; 1">