From bfe8838445c827d38fbad3fdba3de20537ef546b Mon Sep 17 00:00:00 2001
From: Victor Feyens <vfe@odoo.com>
Date: Fri, 18 Feb 2022 14:58:10 +0000
Subject: [PATCH] [IMP] website_sale_slides: forbid adding a course n times in
 cart

* Also remove unused product_template_id param for /shop/cart/update
route

closes odoo/odoo#82374

Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
---
 addons/website_sale_slides/models/sale_order.py          | 9 ++++++++-
 .../views/website_slides_templates.xml                   | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/addons/website_sale_slides/models/sale_order.py b/addons/website_sale_slides/models/sale_order.py
index 08646c8df4c..f3f0f91750a 100644
--- a/addons/website_sale_slides/models/sale_order.py
+++ b/addons/website_sale_slides/models/sale_order.py
@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-from odoo import models, api
+from odoo import models, _
 
 
 class SaleOrder(models.Model):
@@ -32,3 +32,10 @@ class SaleOrder(models.Model):
             channels.sudo()._action_add_members(sale_order.partner_id)
 
         return result
+
+    def _verify_updated_quantity(self, order_line, product_id, new_qty, **kwargs):
+        """Forbid quantity updates on event booth lines."""
+        product = self.env['product.product'].browse(product_id)
+        if product.detailed_type == 'course' and new_qty > 1:
+            return 1, _('You can only add a course once in your cart.')
+        return super()._verify_updated_quantity(order_line, product_id, new_qty, **kwargs)
diff --git a/addons/website_sale_slides/views/website_slides_templates.xml b/addons/website_sale_slides/views/website_slides_templates.xml
index 02dc3bd4216..f5934980103 100644
--- a/addons/website_sale_slides/views/website_slides_templates.xml
+++ b/addons/website_sale_slides/views/website_slides_templates.xml
@@ -110,7 +110,6 @@
                 <form action="/shop/cart/update" method="POST">
                     <input type="hidden" name="csrf_token" t-att-value="request.csrf_token()" />
                     <input type="hidden" class="product_id" name="product_id" t-att-value="channel.product_id.id"/>
-                    <input type="hidden" class="product_template_id" name="product_template_id" t-att-value="channel.product_id.id"/>
                     <a id="add_to_cart" role="button" href="#"
                        class="btn btn-primary btn-block js_check_product o_js_add_to_cart a-submit"
                        data-animation-selector=".o_wslides_course_pict">
@@ -131,6 +130,7 @@
 <template name="Display 'Buy Now'" id="course_option_buy_course_now" inherit_id="website_sale_slides.course_buy_course_button" active="False" customize_show="True">
     <xpath expr="//div[hasclass('add_to_cart_button')]" position="before">
         <div class="mb-1">
+          <!-- FIXME TDE seems strange to redirect to /cart/update with get params when it only supports POST requests -->
             <a role="button" class="btn btn-primary btn-block post_link" t-attf-href="/shop/cart/update?product_id={{channel.product_id.id}}&amp;express=1">
                 <i class="fa fa-bolt"></i> Buy Now
             </a>