Improve: change delete cart item to POST

pimcore · Oct 10, 2023 · 59309c1 · 59309c1
1 parent 3cb015e
commit 59309c1
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/src/Controller/CartController.php b/src/Controller/CartController.php
@@ -136,10 +136,14 @@ public function cartListingAction(Request $request, BreadcrumbHelperService $bre
     }
 
     /**
-     * @Route("/cart/remove-from-cart", name="shop-remove-from-cart")
+     * @Route("/cart/remove-from-cart", name="shop-remove-from-cart", methods={"POST"})
      */
     public function removeFromCartAction(Request $request, Factory $ecommerceFactory): RedirectResponse
     {
+        if (!$this->isCsrfTokenValid('cartListing', $request->request->get('_csrf_token'))) {
+            throw new \Exception('Invalid request');
+        }
+
         $id = $request->query->getInt('id');
         $product = AbstractProduct::getById($id);
 

diff --git a/templates/cart/cart_listing.html.twig b/templates/cart/cart_listing.html.twig
@@ -119,9 +119,9 @@
                                                 </div>
                                             </div>
                                             <div class="col-2 col-sm-2 col-md-1 text-right px-md-0">
-                                                <a href="{{ path('shop-remove-from-cart', {id: item.itemKey}) }}" class="btn btn-outline-danger btn-sm">
+                                                <button type="submit" class="btn btn-outline-danger btn-sm" formaction="{{ path('shop-remove-from-cart', {id: item.itemKey}) }}">
                                                     <i class="fa fa-trash" aria-hidden="true"></i>
-                                                </a>
+                                                </button>
                                             </div>
                                         </div>
                                     </div>