From 41871bf5620b608e2200961323cc83c7cbd87442 Mon Sep 17 00:00:00 2001
From: Joren Van Onder <jov@odoo.com>
Date: Wed, 1 May 2019 23:44:50 +0000
Subject: [FIX] payment: prevent duplicate payments with payment tokens

When paying an eCommerce order with an acquirer which doesn't
redirect (payment_flow: s2s) the "Pay Now" button is correctly
disabled after clicking it. This prevents a user from clicking it
multiple times and being charged multiple times.

When paying with an existing payment token however the button was not
disabled and the user gets no feedback his request is being
processed. Charging an existing payment token takes a while (~5
seconds with Authorize) and so it's possible users will hit the button
multiple times.

This disables the button when reusing an existing payment
token. Additionally it now uses the correct font awesome icon (fa-lock
instead of fa-plus-circle).

opw-1981064

closes odoo/odoo#33196

Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>
---
 addons/payment/static/src/js/payment_form.js | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

(limited to 'addons/payment/static/src/js/payment_form.js')

diff --git a/addons/payment/static/src/js/payment_form.js b/addons/payment/static/src/js/payment_form.js
index 3847141300e..0ba172c849e 100644
--- a/addons/payment/static/src/js/payment_form.js
+++ b/addons/payment/static/src/js/payment_form.js
@@ -29,6 +29,18 @@ odoo.define('payment.payment_form', function (require) {
             $('[data-toggle="tooltip"]').tooltip();
         },
 
+        disableButton: function (button) {
+            $(button).attr('disabled', true);
+            $(button).children('.fa-lock').removeClass('fa-lock');
+            $(button).prepend('<span class="o_loader"><i class="fa fa-refresh fa-spin"></i>&nbsp;</span>');
+        },
+
+        enableButton: function (button) {
+            $(button).attr('disabled', false);
+            $(button).children('.fa').addClass('fa-lock');
+            $(button).find('span.o_loader').remove();
+        },
+
         payEvent: function (ev) {
             ev.preventDefault();
             var form = this.el;
@@ -83,10 +95,7 @@ odoo.define('payment.payment_form', function (require) {
                         return;
                     }
 
-                    $(button).attr('disabled', true);
-                    $(button).children('.fa-plus-circle').removeClass('fa-plus-circle')
-                    $(button).prepend('<span class="o_loader"><i class="fa fa-refresh fa-spin"></i>&nbsp;</span>');
-
+                    this.disableButton(button);
                     var verify_validity = this.$el.find('input[name="verify_validity"]');
 
                     if (verify_validity.length>0) {
@@ -121,14 +130,10 @@ odoo.define('payment.payment_form', function (require) {
                             }
                         }
                         // here we remove the 'processing' icon from the 'add a new payment' button
-                        $(button).attr('disabled', false);
-                        $(button).children('.fa').addClass('fa-plus-circle')
-                        $(button).find('span.o_loader').remove();
+                        self.enableButton(button);
                     }).fail(function (message, data) {
                         // if the rpc fails, pretty obvious
-                        $(button).attr('disabled', false);
-                        $(button).children('.fa').addClass('fa-plus-circle')
-                        $(button).find('span.o_loader').remove();
+                        self.enableButton(button);
 
                         self.displayError(
                             _t('Server Error'),
@@ -191,6 +196,7 @@ odoo.define('payment.payment_form', function (require) {
                     }
                 }
                 else {  // if the user is using an old payment then we just submit the form
+                    this.disableButton(button);
                     form.submit();
                 }
             }
-- 
cgit v1.2.3