feat: Implement order submit token handling in ShopBasketController and update views

2026-03-10 23:19:32 +01:00
parent 1bb599a26a
commit 51ea37d2ec
4 changed files with 110 additions and 29 deletions
--- a/autoload/front/Controllers/ShopBasketController.php
+++ b/autoload/front/Controllers/ShopBasketController.php
@@ -3,6 +3,9 @@ namespace front\Controllers;

 class ShopBasketController
 {
+  private const ORDER_SUBMIT_TOKEN_SESSION_KEY = 'order-submit-token';
+  private const ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY = 'order-submit-last-order-id';
+
  public static $title = [
      'mainView' => 'Koszyk'
  ];
@@ -274,6 +277,7 @@ class ShopBasketController
    }

    $client = \Shared\Helpers\Helpers::get_session( 'client' );
+    $orderSubmitToken = $this->createOrderSubmitToken();

    return \Shared\Tpl\Tpl::view( 'shop-basket/summary-view', [
          'lang_id'        => $lang_id,
@@ -284,12 +288,35 @@ class ShopBasketController
          'addresses'      => ( new \Domain\Client\ClientRepository( $GLOBALS['mdb'] ) )->clientAddresses( (int)$client['id'] ),
          'settings'       => $settings,
          'coupon'         => \Shared\Helpers\Helpers::get_session( 'coupon' ),
-          'basket_message' => \Shared\Helpers\Helpers::get_session( 'basket_message' )
+          'basket_message' => \Shared\Helpers\Helpers::get_session( 'basket_message' ),
+          'order_submit_token' => $orderSubmitToken
      ] );
  }

  public function basketSave()
  {
+    $orderSubmitToken = (string)\Shared\Helpers\Helpers::get( 'order_submit_token', true );
+    $existingOrderId = isset( $_SESSION[ self::ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY ] ) ? (int)$_SESSION[ self::ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY ] : 0;
+
+    if ( !$this->isValidOrderSubmitToken( $orderSubmitToken ) )
+    {
+      if ( $existingOrderId > 0 )
+      {
+        $existingOrderHash = $this->orderRepository->findHashById( $existingOrderId );
+        if ( $existingOrderHash )
+        {
+          header( 'Location: /zamowienie/' . $existingOrderHash );
+          exit;
+        }
+      }
+
+      \Shared\Helpers\Helpers::error( \Shared\Helpers\Helpers::lang( 'zamowienie-zostalo-zlozone-komunikat-blad' ) );
+      header( 'Location: /koszyk' );
+      exit;
+    }
+
+    $this->consumeOrderSubmitToken();
+
    $client = \Shared\Helpers\Helpers::get_session( 'client' );

    if ( \Domain\Basket\BasketCalculator::checkProductQuantityInStock( \Shared\Helpers\Helpers::get_session( 'basket' ) ) )
@@ -322,6 +349,7 @@ class ShopBasketController
        \Shared\Helpers\Helpers::get_session( 'basket_message' )
      ) )
    {
+      \Shared\Helpers\Helpers::set_session( self::ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY, (int)$order_id );
      \Shared\Helpers\Helpers::alert( \Shared\Helpers\Helpers::lang( 'zamowienie-zostalo-zlozone-komunikat' ) );
      \Shared\Helpers\Helpers::delete_session( 'basket' );
      \Shared\Helpers\Helpers::delete_session( 'basket-transport-method-id' );
@@ -414,4 +442,45 @@ class ShopBasketController
    ] );
    exit;
  }
+
+  private function createOrderSubmitToken()
+  {
+    $token = $this->generateOrderSubmitToken();
+    \Shared\Helpers\Helpers::set_session( self::ORDER_SUBMIT_TOKEN_SESSION_KEY, $token );
+    \Shared\Helpers\Helpers::delete_session( self::ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY );
+
+    return $token;
+  }
+
+  private function generateOrderSubmitToken()
+  {
+    try
+    {
+      return bin2hex( random_bytes( 16 ) );
+    }
+    catch ( \Exception $exception )
+    {
+      return md5( uniqid( (string)mt_rand(), true ) );
+    }
+  }
+
+  private function isValidOrderSubmitToken( $token )
+  {
+    if ( !$token )
+      return false;
+
+    $sessionToken = isset( $_SESSION[ self::ORDER_SUBMIT_TOKEN_SESSION_KEY ] ) ? (string)$_SESSION[ self::ORDER_SUBMIT_TOKEN_SESSION_KEY ] : '';
+    if ( !$sessionToken )
+      return false;
+
+    if ( function_exists( 'hash_equals' ) )
+      return hash_equals( $sessionToken, $token );
+
+    return $sessionToken === $token;
+  }
+
+  private function consumeOrderSubmitToken()
+  {
+    \Shared\Helpers\Helpers::delete_session( self::ORDER_SUBMIT_TOKEN_SESSION_KEY );
+  }
 }
--- a/templates/shop-basket/address-form.php
+++ b/templates/shop-basket/address-form.php
@@ -34,6 +34,7 @@
  <? endif;?>
  <? if ( $this -> client ):?><div class="right"><? endif;?>
  <form class="form-horizontal" action="/zloz-zamowienie" method="POST" id="form-order">
+    <input type="hidden" name="order_submit_token" value="<?= htmlspecialchars( (string)($this -> order_submit_token ?? ''), ENT_QUOTES, 'UTF-8' );?>">
    <? if ( !$this -> client ):?>
      <div class="form-group row">
        <div class="col-12">
@@ -198,4 +199,4 @@
      $( '#address-' + address_id ).addClass( 'active' );
    });
  });
-</script>
+</script>
--- a/templates/shop-basket/summary-view.php
+++ b/templates/shop-basket/summary-view.php
@@ -140,14 +140,16 @@
          </div>
          <div class="right">
            <?= \Shared\Tpl\Tpl::view( 'shop-basket/address-form', [
-                'transport_method' => $this -> transport
+                'transport_method' => $this -> transport,
+                'order_submit_token' => $this -> order_submit_token
              ] );?>
          </div>
        <? else:?>
          <?= \Shared\Tpl\Tpl::view( 'shop-basket/address-form', [
              'client' => $this -> client,
              'addresses' => $this -> addresses,
-              'transport_method' => $this -> transport
+              'transport_method' => $this -> transport,
+              'order_submit_token' => $this -> order_submit_token
          ] );?>
        <? endif;?>
      </div>
@@ -156,17 +158,20 @@
  <? endif;?>
 </div>
 <script class="footer" type="text/javascript">
-  document.getElementById('order-send').addEventListener('click', function() {
-    var form = document.getElementById('form-order'); // Zastąp 'form-id' rzeczywistym ID Twojego formularza
-    if (form.checkValidity()) {
-      this.classList.add('loading-button');
-      this.disabled = true;
-      form.submit();
-    } else {
-      // Opcjonalnie: wywołaj funkcję reportValidity(), aby wyświetlić komunikaty o błędach formularza
-      form.reportValidity();
-    }
-  });
+  var orderForm = document.getElementById('form-order');
+  var orderSendButton = document.getElementById('order-send');
+
+  if (orderForm && orderSendButton) {
+    orderForm.addEventListener('submit', function(event) {
+      if (orderSendButton.disabled) {
+        event.preventDefault();
+        return;
+      }
+
+      orderSendButton.classList.add('loading-button');
+      orderSendButton.disabled = true;
+    });
+  }
  <? if ( $this -> settings['google_tag_manager_id'] ):?>
    dataLayer.push({ ecommerce: null });
    dataLayer.push({
@@ -180,4 +185,4 @@
      }
    });
  <? endif;?>
-</script>
+</script>
--- a/templates_user/shop-basket/summary-view.php
+++ b/templates_user/shop-basket/summary-view.php
@@ -134,14 +134,16 @@
          </div>
          <div class="right">
            <?= \Shared\Tpl\Tpl::view( 'shop-basket/address-form', [
-                'transport_method' => $this -> transport
+                'transport_method' => $this -> transport,
+                'order_submit_token' => $this -> order_submit_token
              ] );?>
          </div>
        <? else:?>
          <?= \Shared\Tpl\Tpl::view( 'shop-basket/address-form', [
              'client' => $this -> client,
              'addresses' => $this -> addresses,
-              'transport_method' => $this -> transport
+              'transport_method' => $this -> transport,
+              'order_submit_token' => $this -> order_submit_token
          ] );?>
        <? endif;?>
      </div>
@@ -150,18 +152,22 @@
  <? endif;?>
 </div>
 <script class="footer" type="text/javascript">
-  document.getElementById('order-send').addEventListener('click', function() {
-    var form = document.getElementById('form-order'); // Zastąp 'form-id' rzeczywistym ID Twojego formularza
-    if (form.checkValidity()) {
-      this.classList.add('loading-button');
-      this.disabled = true;
-      form.submit();
-    } else {
-      // Opcjonalnie: wywołaj funkcję reportValidity(), aby wyświetlić komunikaty o błędach formularza
-      form.reportValidity();
-    }
-  });
+  var orderForm = document.getElementById('form-order');
+  var orderSendButton = document.getElementById('order-send');
+
+  if (orderForm && orderSendButton) {
+    orderForm.addEventListener('submit', function(event) {
+      if (orderSendButton.disabled) {
+        event.preventDefault();
+        return;
+      }
+
+      orderSendButton.classList.add('loading-button');
+      orderSendButton.disabled = true;
+    });
+  }
  <? if ( $this -> settings['google_tag_manager_id'] ):?>
+    dataLayer.push({ ecommerce: null });
    dataLayer.push({
      event: "begin_checkout",
      ecommerce: {