I'm trying to add an ajax login to a custom checkout, which is half working. The login goes through, and I'm calling 2 blocks and returning the html in the response. The main content contains the users saved shipping addresses and a new address form, and a sidebar that displays the cart contents.
Up to this point, everything works fine. When I click continue, the ajax call to save the step comes back with a 403. It's coming from the call to
$this->_expireAjax() at the start of the controller save action.
It fails in the first if at
!$this->getOnepage()->getQuote()->hasItems(), this returns true, so it calls
$this->_ajaxRedirectResponse(); and gets the 403.
But in my block it loads the quote just fine, the items are merged and the products in the list are correct.
So in the span of one ajax call, that changes. I've tracked them back and both seems to be calling
Mage::getSingleton('checkout/session')->getQuote() and working off of that. Some of the objects save the model to a class variable, but that and the registry should be newly instantiated because it's a new request, right? So how are they seeing different cart items?