widgets: harden map widget (#73960)

tests/test_widgets.py

@@ -1274,6 +1274,10 @@ def test_map_widget():
     assert '<label' in str(widget.render())
     assert '<label ' not in str(widget.render_widget_content())
 
+    widget = MapWidget('test', title='Map')
+    mock_form_submission(req, widget, hidden_html_vars={'test$latlng': 'blah'})
+    assert widget.has_error()
+
     pub.load_site_options()
     pub.site_options.set('options', 'map-bounds-top-left', '1.23;2.34')
     pub.site_options.set('options', 'map-bounds-bottom-right', '2.34;3.45')

wcs/qommon/form.py

@@ -3272,9 +3272,13 @@ class MapWidget(CompositeWidget):
         CompositeWidget._parse(self, request)
         self.value = self.get('latlng')
         if self.value:
-            lat, lon = self.value.split(';')
-            lat_lon = misc.normalize_geolocation({'lat': lat, 'lon': lon})
-            self.value = '%s;%s' % (lat_lon['lat'], lat_lon['lon']) if lat_lon else None
+            try:
+                lat, lon = self.value.split(';')
+            except ValueError:
+                self.set_error(_('Invalid value'))
+            else:
+                lat_lon = misc.normalize_geolocation({'lat': lat, 'lon': lon})
+                self.value = '%s;%s' % (lat_lon['lat'], lat_lon['lon']) if lat_lon else None
 
     def set_value(self, value):
         super().set_value(value)