Skip to content

fix(portal): submit checkout payments with CSRF protection (v16) #415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Pandiyan5273 wants to merge 1 commit into
base: version-16
Choose a base branch
from
Open

fix(portal): submit checkout payments with CSRF protection (v16) #415

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions webshop/templates/pages/order.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,14 +36,18 @@ <h3 class="m-0">{{ doc.name }}</h3>
</div>
<div class="form-column col-sm-6">
<div class="page-header-actions-block" data-html-block="header-actions">
<p>
{% if enabled_checkout and (doc.doctype != "Sales Invoice" or doc.outstanding_amount > 0) %}
<a href="/api/method/erpnext.accounts.doctype.payment_request.payment_request.make_payment_request?dn={{ doc.name }}&dt={{ doc.doctype }}&submit_doc=1&order_type=Shopping Cart"
class="btn btn-primary btn-sm" id="pay-for-order">
{{ _("Pay") }} {{doc.get_formatted("grand_total") }}
</a>
{% endif %}
</p>
{% if enabled_checkout and show_pay_button %}
<form method="post" action="/api/method/erpnext.accounts.doctype.payment_request.payment_request.make_payment_request">
<input type="hidden" name="csrf_token" value="{{ csrf_token | e }}">
<input type="hidden" name="dn" value="{{ doc.name | e }}">
<input type="hidden" name="dt" value="{{ doc.doctype | e }}">
<input type="hidden" name="submit_doc" value="1">
<input type="hidden" name="order_type" value="Shopping Cart">
<button type="submit" class="btn btn-primary btn-sm" id="pay-for-order">
{{ _("Pay") }} {{ frappe.utils.fmt_money(pay_amount, currency=doc.currency) }}
</button>
</form>
{% endif %}
</div>
</div>
</div>
Expand Down
6 changes: 6 additions & 0 deletions webshop/templates/pages/order.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@
# License: GNU General Public License v3. See license.txt

import frappe
from erpnext.templates.pages.order import get_payment_details
from frappe import _
from frappe.sessions import get_csrf_token

from webshop.webshop.doctype.webshop_settings.webshop_settings import show_attachments

Expand Down Expand Up @@ -38,6 +40,10 @@ def get_context(context):
if not frappe.has_website_permission(context.doc):
frappe.throw(_("Not Permitted"), frappe.PermissionError)

context.show_pay_button, context.pay_amount = get_payment_details(context.doc)
if context.enabled_checkout and context.show_pay_button:
context.csrf_token = get_csrf_token()

if context.doc.get("customer"):
# check for the loyalty program of the customer
customer_loyalty_program = frappe.db.get_value("Customer", context.doc.customer, "loyalty_program")
Expand Down
Loading