diefenbach / django-lfs

An online-shop based on Django
http://www.getlfs.com
BSD 3-Clause "New" or "Revised" License
622 stars 222 forks source link

Can create a submitted order with total not matching items associated with order. #201

Open TWarszawski opened 8 years ago

TWarszawski commented 8 years ago

When a customer check out and adds a product to the cart concurrently, the order total may not accurately reflect the products in the order.

Steps to reproduce:

  1. Start demo site, create a customer, create/pick test product.
  2. Have the customer add the product to the cart and go through checkout up until the submit order step.
  3. In a separate tab or window, log in again as the customer go to the cart page.
  4. Update the quantity in the cart and finish checkout (click the Submit Order button) as close to the same time as possible.

We have reproduced this behavior on a single machine. Because this bug depends on concurrent execution, it may be helpful to introduce additional delay between the server and database. If connecting to the database using unix sockets, the following script can act as a proxy that delays packets: https://gist.github.com/TWarszawski/a0d8dd8aea9eb5b774d64c9f826de6db

Expected Result: The order total matches the sum of the totals for each item in the cart.

Actual Result: The order total reflects the total of the original items in the cart, but when examining the order page the updated items are shown to be associated with the order.