From f6ab2198d7aee40f3b32c64379c9e973bcf85598 Mon Sep 17 00:00:00 2001 From: Damien Bouvy Date: Tue, 3 Sep 2019 07:35:43 +0000 Subject: [PATCH] [FIX] website_sale: don't assert, just check If the session is unbound before a call to this route, this assertion will raise. The point of this code is not to crash when the parameters are incorrect or the session unbound - the point is to avoid leaking incorrect information. Simply return an empty object to the JS code, it will stop polling after a single failed attempt instead of crashing. closes odoo/odoo#36356 Signed-off-by: Damien Bouvy (dbo) --- addons/website_sale/controllers/main.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py index 9412ddce2be..e7c9d060287 100644 --- a/addons/website_sale/controllers/main.py +++ b/addons/website_sale/controllers/main.py @@ -977,7 +977,10 @@ class WebsiteSale(http.Controller): @http.route('/shop/payment/get_status/', type='json', auth="public", website=True) def payment_get_status(self, sale_order_id, **post): order = request.env['sale.order'].sudo().browse(sale_order_id).exists() - assert order.id == request.session.get('sale_last_order_id') + if order.id != request.session.get('sale_last_order_id'): + # either something went wrong or the session is unbound + # prevent recalling every 3rd of a second in the JS widget + return {} return { 'recall': order.get_portal_last_transaction().state == 'pending',