BB-22505: Fix totals checkout data (#35643)

oroinc · Jun 2, 2023 · b7746aa · b7746aa
1 parent 76a1036
commit b7746aa
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 8 deletions.
diff --git a/src/Oro/Bundle/CheckoutBundle/Controller/Frontend/AjaxCheckoutController.php b/src/Oro/Bundle/CheckoutBundle/Controller/Frontend/AjaxCheckoutController.php
@@ -35,9 +35,11 @@ public function getTotalsAction(Request $request, $entityId)
         /** @var Checkout $checkout */
         $checkout = $this->getDoctrine()->getManagerForClass(Checkout::class)
             ->getRepository(Checkout::class)->getCheckoutWithRelations($entityId);
+
         if (!$checkout) {
             return new JsonResponse('', Response::HTTP_NOT_FOUND);
         }
+        $this->denyAccessUnlessGranted('EDIT', $checkout);
 
         $this->setCorrectCheckoutShippingMethodData($checkout, $request);
 

diff --git a/...Bundle/CheckoutBundle/Tests/Functional/Controller/Frontend/AjaxCheckoutControllerTest.php b/...Bundle/CheckoutBundle/Tests/Functional/Controller/Frontend/AjaxCheckoutControllerTest.php
@@ -18,7 +18,7 @@ protected function setUp(): void
     {
         $this->initClient(
             [],
-            $this->generateBasicAuthHeader(LoadCustomerUserData::EMAIL, LoadCustomerUserData::PASSWORD)
+            self::generateBasicAuthHeader(LoadCustomerUserData::EMAIL, LoadCustomerUserData::PASSWORD)
         );
         $this->setCurrentWebsite('default');
         $this->loadFixtures(
@@ -35,25 +35,37 @@ protected function setUp(): void
         );
     }
 
-    public function testGetTotalsActionNotFound()
+    public function testGetTotalsActionNotFound(): void
     {
         $this->client->request('GET', $this->getUrl('oro_checkout_frontend_totals', ['entityId' => 0]));
         $result = $this->client->getResponse();
-        $this->assertJsonResponseStatusCodeEquals($result, 404);
+        self::assertJsonResponseStatusCodeEquals($result, 404);
     }
 
-    public function testGetTotalsAction()
+    public function testGetTotalsAction(): void
     {
-        $checkout = $this->getReference(LoadShoppingListsCheckoutsData::CHECKOUT_1);
+        $checkout = $this->getReference(LoadShoppingListsCheckoutsData::CHECKOUT_7);
 
         $this->client->request(
             'GET',
             $this->getUrl('oro_checkout_frontend_totals', ['entityId' => $checkout->getId()])
         );
         $result = $this->client->getResponse();
-        $this->assertJsonResponseStatusCodeEquals($result, 200);
+        self::assertJsonResponseStatusCodeEquals($result, 200);
         $result = json_decode($result->getContent(), true);
-        $this->assertArrayHasKey('total', $result);
-        $this->assertArrayHasKey('subtotals', $result);
+        self::assertArrayHasKey('total', $result);
+        self::assertArrayHasKey('subtotals', $result);
+    }
+
+    public function testGetTotalsActionOfAnotherCustomerUser(): void
+    {
+        $checkout = $this->getReference(LoadShoppingListsCheckoutsData::CHECKOUT_1);
+
+        $this->client->request(
+            'GET',
+            $this->getUrl('oro_checkout_frontend_totals', ['entityId' => $checkout->getId()])
+        );
+        $result = $this->client->getResponse();
+        self::assertEquals(403, $result->getStatusCode());
     }
 }