awesto / django-shop

A Django based shop system
http://www.django-shop.org
BSD 3-Clause "New" or "Revised" License
3.2k stars 1.04k forks source link

Supporting filter_backends option for ProductRetrieveView #853

Open execut opened 3 years ago

execut commented 3 years ago

Hello! I think there is a flaw in ProductRetrieveView when looking for a product. The product search does not include the current CMS page. As a result, the product can be opened by a link that contains someone else's category. For example, we have an apple product and it is in the fruits category and is located under the /fruits/apple link. But because of this flaw, it can be opened for another existing category of vegetables: /vegetables/apple. This is because there is no filtering on the current CMS page in the product queryset here: https://github.com/awesto/django-shop/blob/13d9a77aff7eede74a5f363c1d540e005d88dbcd/shop/views/catalog.py#L310-L321

How about add to ProductRetrieveView ability support of backend filters like CMSPagesFilterBackend?:

filter_backends = [CMSPagesFilterBackend]
filter_backends.extend(api_settings.DEFAULT_FILTER_BACKENDS)
return [
    ...
    url(r'^(?P<slug>[\w-]+)', ProductRetrieveView.as_view(
        filter_backends=filter_backends,
    )),