1

After SUPEE 7405 installation, when using AJAX product delete action, it throws an error "Cannot remove the item." This message is due to added FORM-KEY validation into app/code/core/Mage/Checkout/controllers/CartController.php

Now, the question is: How to fix this issue? I've received comments saying I need to add a FORM-KEY to .phtml file responsible in ajax. But I DO NOT know which code to insert or file exactly I need to edit.

Any help?

4

I have it working by using the following as my deleteURL:

echo Mage::getUrl('checkout/cart/delete', array('id' => $item->getId()))
    . "form_key/" . Mage::getSingleton('core/session')->getFormKey();

Hope this helps someone

2

Ok let me clarify this a bit.

With patch 7405, the form_key is added directly to the getDeleteUrl function of the Mage_Checkout_Block_Cart_Item_Renderer block.

Thus when you inspect your delete link the href attribute should look like this:

http://yourstore.com/checkout/cart/delete/id/<product_id>/form_key/<the_form_key>/uenc/<encoded_part>/

There is no need to add the form key to the template as it's directly added to the URL.

If your delete URL does not have the form_key in it, that means you have a module that overrides the Mage_Checkout_Block_Cart_Item_Renderer block and thus, you need to modify this module so the getDeleteUrl function adds the form key to the URL.

If your delete URL does contain the form key, then you probably have a caching system that caches that specific block and thus provides the wrong form key.

  • I found delete link. It looks like this: /checkout/cart/delete/id/555/uenc/aHR0cDovL3d3dy5zaGF2aW5nc3f7fd77fd7e32Vzc29yaWVzLw/?___SID=U. I noticed the form key is added after page refresh. Once I add a product I get the url I posted. After page refresh Form-key is added to the URL and product deletes. – Icon Jan 26 '16 at 18:46
1

EDIT
Not the right wray to do, please see @DigitalPianism answer : https://magento.stackexchange.com/a/98957/33619


If I am not wrong you have to add a hidden input to your form :

<input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />

To find the right .phtml file you can use Magento template path hints.
Here you can find how to do it : http://help.sweettoothrewards.com/article/434-how-do-i-turn-on-template-path-hints

  • doesn't work :( – Icon Jan 25 '16 at 20:52
  • 1
    Can you be more precise in what is not working ? Does it not working even if the input is added ? – Matthéo Geoffray Jan 25 '16 at 21:23
  • I've added the code to template/checkout/cart/sidebar/default.phtml., thats my AJAX. No change, same error pops up when I try to delete a product. – Icon Jan 25 '16 at 22:26
  • 1
    When you debug your AJAX request did you see the param form_key sent ? – Matthéo Geoffray Jan 25 '16 at 23:16
  • I didn't debug, how to do that? – Icon Jan 25 '16 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.