From b8ac14131059cea10b4f6758ccb8e440a8d234ac Mon Sep 17 00:00:00 2001
From: Midgard <midgard@zeus.ugent.be>
Date: Mon, 24 Feb 2020 14:19:20 +0100
Subject: [PATCH] Fix mistake in dish change detection

When the form is submitted, the URL has no dish parameter any more.
To fix this, add a hidden form field to say which dish the form was for.
---
 app/templates/order.html | 1 +
 app/views/order.py       | 9 +++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/app/templates/order.html b/app/templates/order.html
index ed4271d..e58e7bd 100644
--- a/app/templates/order.html
+++ b/app/templates/order.html
@@ -54,6 +54,7 @@
             </div>
 
             {% if dish and dish.choices %}
+                <input type="hidden" name="form_for_dish" value="{{ dish.id }}" />
                 {% for (choice_type, choice) in dish.choices %}
                     <div class="form-group select2-container select2">
                         <label class="control-label" for="choice_{{ choice.id }}">{{ choice.name }}</label><br/>
diff --git a/app/views/order.py b/app/views/order.py
index 5222768..aa67663 100644
--- a/app/views/order.py
+++ b/app/views/order.py
@@ -126,15 +126,16 @@ def order_item_create(order_id: int) -> typing.Any:
     form = AnonOrderItemForm() if current_user.is_anonymous() \
         else OrderItemForm()
 
-    dish_id_in_url = request.args.get("dish")
-    dish_id = form.dish_id.data if form.is_submitted() else dish_id_in_url
+    dish_id = form.dish_id.data if form.is_submitted() else request.args.get("dish")
     if dish_id and not location.dish_by_id(dish_id):
         abort(404)
     form.dish_id.data = dish_id
     form.populate(current_order.location, dish_id)
 
-    # If the form was not submitted (GET request), the form had errors, or the dish was changed: show form again
-    if not form.validate_on_submit() or (dish_id_in_url and dish_id_in_url != dish_id):
+    # If the form was not submitted (GET request), the form had errors,
+    # or the dish was changed: show form again
+    dish_was_changed = request.form.get("form_for_dish_id") and request.form["form_for_dish_id"] != dish_id
+    if not form.validate_on_submit() or dish_was_changed:
         return order_from_id(order_id, form=form, dish_id=dish_id)
 
     # Form was submitted and is valid