[FIX] payment{,_stripe},sale: special character in reference

Special character in reference (eg. '#' character in invoice sequence)
might cause error for payment acquirer.

For example with stripe we get the error on:

    {'error': {'code': 'url_invalid',
     'doc_url': 'https://stripe.com/docs/error-codes/url-invalid',
     'message': 'Not a valid URL', 'param': 'success_url',
     'type': 'invalid_request_error'}}

Or an error because prepare_tx_url is broken.

With this changeset, when a payment reference is used inside an url, we
quote it.

opw-2479658

note: also uses url_quote_plus in payment.link.wizard()._generate_link
since this is what is expected by werkzeug (previously + characters
became spaces).

closes odoo/odoo#68577

X-original-commit: 47645c2f170d5a7c09ae80d4e0de6c3a821f7b36
Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>

4 files changed, 7 insertions, 4 deletions

diff --git a/addons/payment/views/payment_portal_templates.xml b/addons/payment/views/payment_portal_templates.xml
index 3158614a21f..c126368b937 100644
--- a/addons/payment/views/payment_portal_templates.xml
+++ b/addons/payment/views/payment_portal_templates.xml
@@ -51,8 +51,11 @@
                             <p><b>Amount:</b> <t t-esc="amount" t-options="{'widget': 'monetary', 'display_currency': currency}"/></p>
                             <t t-call="payment.payment_tokens_list" t-if="reference and amount and currency">
                                 <t t-set="mode" t-value="'payment'"/>
+                                <t t-set="_overriden_reference" t-value="reference"/>
+                                <t t-set="reference" t-value="quote_plus(reference).replace('+','%20')"/>
                                 <t t-set="prepare_tx_url" t-value="'/website_payment/transaction/v2/' + str(amount) + '/' + str(currency.id) + '/' + reference + (('/' + str(partner_id)) if partner_id else '')"/>
                                 <t t-set="form_action" t-value="'/website_payment/token/v2/' + str(amount) + '/' + str(currency.id) + '/' + reference + (('/' + str(partner_id)) if partner_id else '')"/>
+                                <t t-set="reference" t-value="_overriden_reference"/>
                             </t>
                             <div t-if="not acquirers" class="alert alert-danger" role="alert">
                                 <p>No payment acquirer found.</p>
diff --git a/addons/payment/wizards/payment_link_wizard.py b/addons/payment/wizards/payment_link_wizard.py
index ccd69ed342e..54c03c5de5e 100644
--- a/addons/payment/wizards/payment_link_wizard.py
+++ b/addons/payment/wizards/payment_link_wizard.py
@@ -72,7 +72,7 @@ class PaymentLinkWizard(models.TransientModel):
             link = ('%s/website_payment/pay?reference=%s&amount=%s&currency_id=%s'
                     '&partner_id=%s&access_token=%s') % (
                         record.get_base_url(),
-                        urls.url_quote(payment_link.description),
+                        urls.url_quote_plus(payment_link.description),
                         payment_link.amount,
                         payment_link.currency_id.id,
                         payment_link.partner_id.id,
diff --git a/addons/payment_stripe/models/payment.py b/addons/payment_stripe/models/payment.py
index 53ac5f5682a..d09a6977c1c 100644
--- a/addons/payment_stripe/models/payment.py
+++ b/addons/payment_stripe/models/payment.py
@@ -58,8 +58,8 @@ class PaymentAcquirerStripe(models.Model):
             'line_items[][quantity]': 1,
             'line_items[][name]': tx_values['reference'],
             'client_reference_id': tx_values['reference'],
-            'success_url': urls.url_join(base_url, StripeController._success_url) + '?reference=%s' % tx_values['reference'],
-            'cancel_url': urls.url_join(base_url, StripeController._cancel_url) + '?reference=%s' % tx_values['reference'],
+            'success_url': urls.url_join(base_url, StripeController._success_url) + '?reference=%s' % urls.url_quote_plus(tx_values['reference']),
+            'cancel_url': urls.url_join(base_url, StripeController._cancel_url) + '?reference=%s' % urls.url_quote_plus(tx_values['reference']),
             'payment_intent_data[description]': tx_values['reference'],
             'customer_email': tx_values.get('partner_email') or tx_values.get('billing_partner_email'),
         }
diff --git a/addons/sale/wizard/sale_payment_link.py b/addons/sale/wizard/sale_payment_link.py
index 5c72cf109ee..810c610ac02 100644
--- a/addons/sale/wizard/sale_payment_link.py
+++ b/addons/sale/wizard/sale_payment_link.py
@@ -37,7 +37,7 @@ class SalePaymentLink(models.TransientModel):
                 payment_link.link = ('%s/website_payment/pay?reference=%s&amount=%s&currency_id=%s'
                                     '&partner_id=%s&order_id=%s&company_id=%s&access_token=%s') % (
                                         record.get_base_url(),
-                                        urls.url_quote(payment_link.description),
+                                        urls.url_quote_plus(payment_link.description),
                                         payment_link.amount,
                                         payment_link.currency_id.id,
                                         payment_link.partner_id.id,