diff options
| author | DramixDw <rve@odoo.com> | 2020-05-25 15:50:39 +0000 |
|---|---|---|
| committer | Jeremy Kersten <jke@odoo.com> | 2020-05-29 15:09:42 +0000 |
| commit | 8edac8ab977d0f124076755654d754223206df74 (patch) | |
| tree | 6037054ca7739a9ab96ecf320b8d781f082a1c71 /addons/website_sale_slides | |
| parent | 0f2cada32319b3910d6ace6d412cfa94a646c9c7 (diff) | |
[IMP] website_sale: /shop/cart/update as POST with csrf
The /shop/cart/update was accepting both GET and POST request. Therefore,
we couldn't have csrf on the route meaning any website could change your
cart if the route was known.
task-2263776
closes odoo/odoo#51486
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
Diffstat (limited to 'addons/website_sale_slides')
| -rw-r--r-- | addons/website_sale_slides/static/src/js/slides_course_join.js | 7 | ||||
| -rw-r--r-- | addons/website_sale_slides/views/website_slides_templates.xml | 2 |
2 files changed, 6 insertions, 3 deletions
diff --git a/addons/website_sale_slides/static/src/js/slides_course_join.js b/addons/website_sale_slides/static/src/js/slides_course_join.js index 22ebe96da3e..4fe1c28a7ba 100644 --- a/addons/website_sale_slides/static/src/js/slides_course_join.js +++ b/addons/website_sale_slides/static/src/js/slides_course_join.js @@ -2,6 +2,7 @@ odoo.define('website_sale_slides.course.join.widget', function (require) { "use strict"; var CourseJoinWidget = require('website_slides.course.join.widget').courseJoinWidget; +const wUtils = require('website.utils'); CourseJoinWidget.include({ xmlDependencies: (CourseJoinWidget.prototype.xmlDependencies || []).concat( @@ -28,9 +29,11 @@ CourseJoinWidget.include({ ev.preventDefault(); if (this.channel.channelEnroll === 'payment' && !this.publicUser) { - var shopUrl = _.str.sprintf('/shop/cart/update?product_id=%s&express=1', this.productId); this.beforeJoin().then(function () { - window.location.href = shopUrl; + wUtils.sendRequest('/shop/cart/update', { + product_id: this.productId, + express: 1, + }); }); } else { this._super.apply(this, arguments); diff --git a/addons/website_sale_slides/views/website_slides_templates.xml b/addons/website_sale_slides/views/website_slides_templates.xml index dd265ffee73..23fac6fe918 100644 --- a/addons/website_sale_slides/views/website_slides_templates.xml +++ b/addons/website_sale_slides/views/website_slides_templates.xml @@ -142,7 +142,7 @@ <template name="Allow Buy Now" id="course_option_buy_course_now" inherit_id="website_sale_slides.course_buy_course_button" active="False" customize_show="True"> <xpath expr="//div[hasclass('buy_now_button')]" position="inside"> <div style="margin-top:5px;"> - <a role="button" class="btn btn-outline-primary btn-block" t-att-href="'/shop/cart/update?product_id=%s&express=1' % channel.product_id.id"> + <a role="button" class="btn btn-outline-primary btn-block post_link" t-att-href="'/shop/cart/update?product_id=%s&express=1' % channel.product_id.id"> <i class="fa fa-bolt"></i> Buy Now </a> </div> |