Project-Pro/shopPRO
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: ochrona przed podwójnym składaniem zamówienia (order submit token)

Browse Source 
Token CSRF w sesji zapobiega duplikowaniu zamówień przy wielokrotnym
kliknięciu przycisku. Przy duplikacie przekierowanie do istniejącego
zamówienia. JS naprawiony — nasłuch na submit formularza zamiast click.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jacek
2026-03-10 21:50:21 +01:00
parent e0a1847127
commit c7be154d57
8 changed files with 151 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
templates/shop-basket/summary-view.php
View File

@@ -140,14 +140,16 @@
</div>
<div class="right">
<?= \Shared\Tpl\Tpl::view( 'shop-basket/address-form', [
'transport_method' => $this -> transport
'transport_method' => $this -> transport,
'order_submit_token' => $this -> order_submit_token
] );?>
</div>
<? else:?>
<?= \Shared\Tpl\Tpl::view( 'shop-basket/address-form', [
'client' => $this -> client,
'addresses' => $this -> addresses,
'transport_method' => $this -> transport
'transport_method' => $this -> transport,
'order_submit_token' => $this -> order_submit_token
] );?>
<? endif;?>
</div>
@@ -156,17 +158,20 @@
<? endif;?>
</div>
<script class="footer" type="text/javascript">
document.getElementById('order-send').addEventListener('click', function() {
var form = document.getElementById('form-order'); // Zastąp 'form-id' rzeczywistym ID Twojego formularza
if (form.checkValidity()) {
this.classList.add('loading-button');
this.disabled = true;
form.submit();
} else {
// Opcjonalnie: wywołaj funkcję reportValidity(), aby wyświetlić komunikaty o błędach formularza
form.reportValidity();
}
});
var orderForm = document.getElementById('form-order');
var orderSendButton = document.getElementById('order-send');
if (orderForm && orderSendButton) {
orderForm.addEventListener('submit', function(event) {
if (orderSendButton.disabled) {
event.preventDefault();
return;
}
orderSendButton.classList.add('loading-button');
orderSendButton.disabled = true;
});
}
<? if ( $this -> settings['google_tag_manager_id'] ):?>
dataLayer.push({ ecommerce: null });
dataLayer.push({
@@ -180,4 +185,4 @@
}
});
<? endif;?>
</script>
</script>