[FIX] website_quote: prevent to add options to a confirmed order

addons/website_quote/controllers/main.py

@@ -140,6 +140,8 @@ class sale_quote(http.Controller):
         order = request.registry.get('sale.order').browse(request.cr, SUPERUSER_ID, order_id)
         if token != order.access_token:
             return request.website.render('website.404')
+        if order.state not in ['draft', 'sent']:
+            return request.website.render('website.http_error', {'status_code': 'Forbidden', 'status_message': _('You cannot add options to a confirmed order.')})
         option_obj = request.registry.get('sale.order.option')
         option = option_obj.browse(request.cr, SUPERUSER_ID, option_id)
 

addons/website_quote/views/website_quotation.xml

@@ -458,7 +458,7 @@
                                     </div>
                                 </strong>
                             </td>
-                            <td class="pull-right">
+                            <td class="pull-right" t-if="quotation.state in ['draft', 'sent']">
                                 <a t-attf-href="/quote/add_line/#{ option.id }/#{ quotation.id }/#{ quotation.access_token }" class="mb8 hidden-print">
                                     <span class="fa fa-shopping-cart"/>
                                 </a>