Odoo Changelog — 2025-09-17

Wednesday, September 17, 2025

1 change · 18.0

Security(1)

Security fixes and vulnerability patches

[FIX] payment_razorpay_oauth: prevent error when csrf is missing

Core18.0payment_razorpay_oauthSECURITY

This fix prevents an error during Razorpay onboarding when required security information is missing from the return request. Instead of failing unexpectedly, Odoo now rejects the request cleanly, improving reliability and keeping the payment setup flow secure.

Original PR description

Before this commit, the return endpoint expected `csrf_token` in the data. If it was missing, a `KeyError` was raised at line [1].

**Error:**
`KeyError: 'csrf_token'`

**Solution:**
Now we use `.get('csrf_token')` and explicitly handle the missing case. If the token is missing or invalid, the controller raises `Forbidden()` [2], ensuring the request is rejected gracefully and securely.

[1]: https://github.com/odoo/odoo/blob/ae8ce340b8a397582899cdee0fd252d8613c12b5/addons/payment_razorpay_oauth/controllers/onboarding.py#L37

[2]: https://github.com/odoo/odoo/blob/ae8ce340b8a397582899cdee0fd252d8613c12b5/addons/payment_razorpay_oauth/controllers/onboarding.py#L43-L45

sentry-6869319716
---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

#razorpay#payments#onboarding#csrf