[FIX] website_sale: prevents the modification of a SO line if SO is not 'draft'

opw-634681

addons/website_sale/controllers/main.py

@@ -330,6 +330,10 @@ class website_sale(http.Controller):
     @http.route(['/shop/cart/update_json'], type='json', auth="public", methods=['POST'], website=True)
     def cart_update_json(self, product_id, line_id, add_qty=None, set_qty=None, display=True):
         order = request.website.sale_get_order(force_create=1)
+        if order.state != 'draft':
+            request.website.sale_reset()
+            return {}
+
         value = order._cart_update(product_id=product_id, line_id=line_id, add_qty=add_qty, set_qty=set_qty)
         if not display:
             return None

addons/website_sale/models/sale_order.py

@@ -4,6 +4,7 @@ import random
 from openerp import SUPERUSER_ID
 from openerp.osv import osv, orm, fields
 from openerp.addons.web.http import request
+from openerp.tools.translate import _
 
 
 class sale_order(osv.Model):
@@ -73,6 +74,8 @@ class sale_order(osv.Model):
 
         quantity = 0
         for so in self.browse(cr, uid, ids, context=context):
+            if so.state != 'draft':
+                raise osv.except_osv(_('Error!'), _('It is forbidden to modify a sale order which is not in draft status'))
             if line_id != False:
                 line_ids = so._cart_find_product_line(product_id, line_id, context=context, **kwargs)
                 if line_ids: