From a14a8e47fe3dfcfb65da0e442322053b7ec76fb7 Mon Sep 17 00:00:00 2001
From: Nicolas Galler <ngl@odoo.com>
Date: Mon, 26 Oct 2020 08:49:51 +0000
Subject: [PATCH] [FIX] website_form: prevent double clicking send

Behavior prior to the commit:

A user can double click the "Send" button when submitting a form on the
website.  Because the event handler is removed on the first click, the
second submission uses the browser default behavior and posts the form
to an incorrect URL, resulting in a 404 error for the user.

Behavior after the commit:

The button is disabled after the first click.

Note:

Using `.attr('disabled')` is sufficient both to disable the button and
to give the disabled visual on all browsers since IE9, but we keep
`.addClass('disabled')` and `.off()` for cases where the clickable is not a
`button` but a link.

opw-2356402

closes odoo/odoo#61111

X-original-commit: 0eed92da709dba843a7f2f82aee772313e3d4630
Signed-off-by: Nicolas Galler <nicocrm@users.noreply.github.com>
---
 .../static/src/snippets/s_website_form/000.js        | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/addons/website_form/static/src/snippets/s_website_form/000.js b/addons/website_form/static/src/snippets/s_website_form/000.js
index 573656d5b92..3b03fa390d5 100644
--- a/addons/website_form/static/src/snippets/s_website_form/000.js
+++ b/addons/website_form/static/src/snippets/s_website_form/000.js
@@ -98,7 +98,9 @@ odoo.define('website_form.s_website_form', function (require) {
         send: async function (e) {
             e.preventDefault(); // Prevent the default submit behavior
              // Prevent users from crazy clicking
-            this.$target.find('.s_website_form_send, .o_website_form_send').addClass('disabled'); // !compatibility
+            this.$target.find('.s_website_form_send, .o_website_form_send')
+                .addClass('disabled')    // !compatibility
+                .attr('disabled', 'disabled');
 
             var self = this;
 
@@ -164,7 +166,9 @@ odoo.define('website_form.s_website_form', function (require) {
             ajax.post(this.$target.attr('action') + (this.$target.data('force_action') || this.$target.data('model_name')), form_values)
             .then(function (result_data) {
                 // Restore send button behavior
-                self.$target.find('.s_website_form_send, .o_website_form_send').removeClass('disabled'); // !compatibility
+                self.$target.find('.s_website_form_send, .o_website_form_send')
+                    .removeAttr('disabled')
+                    .removeClass('disabled'); // !compatibility
                 result_data = JSON.parse(result_data);
                 if (!result_data.id) {
                     // Failure, the server didn't return the created record ID
@@ -295,7 +299,9 @@ odoo.define('website_form.s_website_form', function (require) {
 
         update_status: function (status, message) {
             if (status !== 'success') { // Restore send button behavior if result is an error
-                this.$target.find('.s_website_form_send, .o_website_form_send').removeClass('disabled'); // !compatibility
+                this.$target.find('.s_website_form_send, .o_website_form_send')
+                    .removeAttr('disabled')
+                    .removeClass('disabled'); // !compatibility
             }
             var $result = this.$('#s_website_form_result, #o_website_form_result'); // !compatibility