diff options
| author | Damien Bouvy <dbo@odoo.com> | 2015-10-09 16:50:23 +0200 |
|---|---|---|
| committer | Damien Bouvy <dbo@odoo.com> | 2015-10-12 10:43:46 +0200 |
| commit | 486cd33091b23924a73dd5bc0dbaee59bb10d85d (patch) | |
| tree | 755f464efb656a0c64f0300a85780221f16a1fe4 | |
| parent | 81418ec14eda89b0d6036bdbc6c7731b56972aff (diff) | |
[FIX] website_quote: prevent modifying the quote state if it's already been processed
Before this fix, it was possible to validate then cancel a quote (or the other way around) simply by using two tabs in your browser. From now on, we only validate/cancel a quote if it's the 'sent' state and advise the customer of the situation if he tries to abuse the process.
| -rw-r--r-- | addons/website_quote/controllers/main.py | 4 | ||||
| -rw-r--r-- | addons/website_quote/static/src/js/website_quotation.js | 3 | ||||
| -rw-r--r-- | addons/website_quote/views/website_quotation.xml | 8 |
3 files changed, 14 insertions, 1 deletions
diff --git a/addons/website_quote/controllers/main.py b/addons/website_quote/controllers/main.py index 2eeb3c4a645..bc42deb42a9 100644 --- a/addons/website_quote/controllers/main.py +++ b/addons/website_quote/controllers/main.py @@ -64,6 +64,8 @@ class sale_quote(http.Controller): order = order_obj.browse(request.cr, SUPERUSER_ID, order_id) if token != order.access_token: return request.website.render('website.404') + if order.state != 'sent': + return False attachments=sign and [('signature.png', sign.decode('base64'))] or [] order_obj.signal_workflow(request.cr, SUPERUSER_ID, [order_id], 'order_confirm', context=request.context) message = _('Order signed by %s') % (signer,) @@ -76,6 +78,8 @@ class sale_quote(http.Controller): order = order_obj.browse(request.cr, SUPERUSER_ID, order_id) if token != order.access_token: return request.website.render('website.404') + if order.state != 'sent': + return werkzeug.utils.redirect("/quote/%s/%s?message=4" % (order_id, token)) request.registry.get('sale.order').action_cancel(request.cr, SUPERUSER_ID, [order_id]) message = post.get('decline_message') if message: diff --git a/addons/website_quote/static/src/js/website_quotation.js b/addons/website_quote/static/src/js/website_quotation.js index 37f5e2a9a62..8a1a3fcf739 100644 --- a/addons/website_quote/static/src/js/website_quotation.js +++ b/addons/website_quote/static/src/js/website_quotation.js @@ -63,8 +63,9 @@ website.if_dom_contains('div.o_website_quote', function () { 'signer': signer_name, 'sign': sign?JSON.stringify(sign[1]):false, }).then(function (data) { + var message_id = (data) ? 3 : 4; $('#modelaccept').modal('hide'); - window.location.href = '/quote/'+order_id[1]+'/'+token+'?message=3'; + window.location.href = '/quote/'+order_id[1]+'/'+token+'?message='+message_id; }); return false; }); diff --git a/addons/website_quote/views/website_quotation.xml b/addons/website_quote/views/website_quotation.xml index 2d64735d756..b8efd0c946d 100644 --- a/addons/website_quote/views/website_quotation.xml +++ b/addons/website_quote/views/website_quotation.xml @@ -252,6 +252,14 @@ and do not hesitate to <a href="#discussion">contact us</a> for any question. </div> + <div class="alert alert-warning alert-dismissable" t-if="message==4 and quotation.state != 'sent'"> + <button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button> + This order has already been + <t t-if="quotation.state=='cancel'">cancelled</t> + <t t-if="quotation.state not in ('cancel','draft')">validated</t> + ! You can <a href="#discussion">contact us</a> for + any question. + </div> <a id="introduction"/> <h1 class="page-header mt16"> <span t-if="quotation.state in ('draft','sent','cancel')">Your Quotation</span> |