From dae95dd373c4c05d517e721c3d41b1124457e9a7 Mon Sep 17 00:00:00 2001
From: Agniva De Sarker <agnivade@yahoo.co.in>
Date: Wed, 16 Dec 2020 14:26:06 +0530
Subject: [PATCH] MM-30826: Sentry crash: nil deference in
 model.AuthorizeRequest (#16563)

The return statement after setting c.InvalidParam was missing

https://mattermost.atlassian.net/browse/MM-30826

```release-note
NONE
```
---
 web/oauth.go      |  1 +
 web/oauth_test.go | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/web/oauth.go b/web/oauth.go
index 534303a3c0..ac38f72b32 100644
--- a/web/oauth.go
+++ b/web/oauth.go
@@ -46,6 +46,7 @@ func authorizeOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 	authRequest := model.AuthorizeRequestFromJson(r.Body)
 	if authRequest == nil {
 		c.SetInvalidParam("authorize_request")
+		return
 	}
 
 	if err := authRequest.IsValid(); err != nil {
diff --git a/web/oauth_test.go b/web/oauth_test.go
index bc64568cba..6f0d2e16c8 100644
--- a/web/oauth_test.go
+++ b/web/oauth_test.go
@@ -129,6 +129,16 @@ func TestAuthorizeOAuthApp(t *testing.T) {
 	CheckNotFoundStatus(t, resp)
 }
 
+func TestNilAuthorizeOAuthApp(t *testing.T) {
+	th := Setup(t).InitBasic()
+	th.Login(ApiClient, th.SystemAdminUser)
+	defer th.TearDown()
+
+	_, resp := ApiClient.AuthorizeOAuthApp(nil)
+	require.NotNil(t, resp.Error)
+	assert.Equal(t, "api.context.invalid_body_param.app_error", resp.Error.Id)
+}
+
 func TestDeauthorizeOAuthApp(t *testing.T) {
 	th := Setup(t).InitBasic()
 	th.Login(ApiClient, th.SystemAdminUser)