engineering/make_post_sell
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases 2 Packages Wiki Activity Actions

Only allow carts without owners to be modified by unauthenticated users.

Browse source 
If a cart has an owner, only the owner can make changes to it.

	modified:   make_post_sell/views/cart.py
This commit is contained in:
Russell Ballestrini 2024-06-17 18:43:02 -04:00
parent c9460d10ed
commit 62283edffd
1 changed files with 48 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

75
make_post_sell/views/cart.py
View file

@ -172,8 +172,12 @@ def cart_by_id(request):
if cart is None:
msg = ("That cart_id does not exist.", "error")
elif cart.public or (
request.user and request.user.authenticated and request.user.owns_cart(cart)
elif (
cart.user is None
or cart.public
or (
request.user and request.user.authenticated and request.user.owns_cart(cart)
)
):
# remove invalid coupons from cart, if any.
for coupon in cart.coupons:
@ -217,27 +221,28 @@ def cart_add_product(request):
product = get_product_by_id(request.dbsession, product_id)
if product is None:
if request.user and request.user.does_not_own_cart(request.active_cart):
msg = ("You do not own this cart.", "error")
elif product is None:
msg = ("invalid product_id.", "error")
request.session.flash(msg)
return HTTPFound(get_referer_or_home(request))
elif product.is_not_ready:
msg = ("that product is not ready for purchase.", "error")
request.session.flash(msg)
return HTTPFound(get_referer_or_home(request))
elif product.is_not_sellable:
msg = ("that content is not for sale or purchase.", "error")
request.session.flash(msg)
return HTTPFound(get_referer_or_home(request))
msg = ('You added "{}" to your cart.'.format(product.title), "success")
request.active_cart.add_product(product)
request.dbsession.add(request.active_cart)
request.dbsession.flush()
else:
msg = ('You added "{}" to your cart.'.format(product.title), "success")
request.active_cart.add_product(product)
request.dbsession.add(request.active_cart)
request.dbsession.flush()
request.session.flash(msg)
return HTTPFound("/cart")
request.session.flash(msg)
return HTTPFound("/cart")
return HTTPFound(get_referer_or_home(request))
@view_config(route_name="cart_remove_product")
@ -255,21 +260,25 @@ def cart_remove_product(request):
if cart is None:
msg = ("That cart_id does not exist.", "error")
elif request.user and request.user.does_not_own_cart(cart):
msg = ("You do not own this cart.", "error")
elif request.user is None and cart.user is not None:
msg = ("You do not own this cart.", "error")
elif request.user is None and cart.user is not None:
msg = ("You do not own this cart.", "error")
elif product is None:
msg = ("That product_id does not exist.", "error")
elif cart.active or (
request.user and request.user.authenticated and request.user.owns_cart(cart)
):
else:
msg = ('You removed "{}" from the cart.'.format(product.title), "success")
cart.remove_product(product)
cart.remove_handling_if_no_physical_products()
request.dbsession.add(cart)
request.dbsession.flush()
else:
msg = ("You do not own that cart.", "error")
request.session.flash(msg)
return HTTPFound(get_referer_or_home(request))
@ -302,6 +311,16 @@ def cart_quantity_product(request):
if cart is None:
msg = ("That cart_id does not exist.", "error")
elif request.user and request.user.does_not_own_cart(cart):
msg = ("You do not own this cart.", "error")
request.session.flash(msg)
return HTTPFound(get_referer_or_home(request))
elif request.user is None and cart.user is not None:
msg = ("You do not own this cart.", "error")
request.session.flash(msg)
return HTTPFound(get_referer_or_home(request))
elif product is None:
msg = ("That product_id does not exist.", "error")
request.session.flash(msg)
@ -314,10 +333,7 @@ def cart_quantity_product(request):
("Refusing to add a product from another shop to cart.", "error")
)
return HTTPFound("/cart")
elif cart.active or (
request.user and request.user.authenticated and request.user.owns_cart(cart)
):
else:
msg = (
'You updated the quantity of "{}" in the cart.'.format(product.title),
"success",
@ -326,9 +342,6 @@ def cart_quantity_product(request):
request.dbsession.add(cart)
request.dbsession.flush()
else:
msg = ("You do not own that cart.", "error")
request.session.flash(msg)
return HTTPFound(get_referer_or_home(request))
@ -338,6 +351,14 @@ def cart_handling_option(request):
cart = get_cart_from_matchdict(request)
handling_option = request.params.get("handling_option")
if request.user and request.user.does_not_own_cart(cart):
request.session.flash(("You do not own this cart.", "error"))
return HTTPFound(get_referer_or_home(request))
if request.user is None and cart.user is not None:
request.session.flash(("You do not own this cart.", "error"))
return HTTPFound(get_referer_or_home(request))
if handling_option not in [
"local_pickup",
"local_delivery",