[PATCH] Upstream patch - 26062023

addons/google_account/controllers/main.py

@@ -2,6 +2,7 @@
 # Part of Odoo, Flectra. See LICENSE file for full copyright and licensing details.
 
 import json
+from werkzeug.exceptions import BadRequest
 from werkzeug.utils import redirect
 
 from flectra import http, registry
@@ -13,11 +14,13 @@ class GoogleAuth(http.Controller):
     @http.route('/google_account/authentication', type='http', auth="public")
     def oauth2callback(self, **kw):
         """ This route/function is called by Google when user Accept/Refuse the consent of Google """
-        state = json.loads(kw['state'])
+        state = json.loads(kw.get('state', '{}'))
         dbname = state.get('d')
         service = state.get('s')
         url_return = state.get('f')
         base_url = request.httprequest.url_root.strip('/')
+        if (not dbname or not service or (kw.get('code') and not url_return)):
+            raise BadRequest()
 
         with registry(dbname).cursor() as cr:
             if kw.get('code'):