From 20e4d74b2e63702c63a122c8b603081829650ca0 Mon Sep 17 00:00:00 2001
From: rGaillard <remi.gaillard@prestashop.com>
Date: Thu, 4 Oct 2012 09:27:14 +0000
Subject: [PATCH] // Fix #PSCFV-4675

---
 controllers/front/CartController.php | 3 +++
 themes/default/product-list.tpl      | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/controllers/front/CartController.php b/controllers/front/CartController.php
index 29c63bffb..e287c2eda 100644
--- a/controllers/front/CartController.php
+++ b/controllers/front/CartController.php
@@ -92,7 +92,10 @@ class CartControllerCore extends FrontController
 
 				Tools::redirect('index.php?controller=order&'.(isset($this->id_product) ? 'ipa='.$this->id_product : ''));
 			}
+
 		}
+		elseif (!$this->isTokenValid())
+			Tools::redirect('index.php');
 	}
 
 	/**
diff --git a/themes/default/product-list.tpl b/themes/default/product-list.tpl
index 55d7f6313..cd69727d6 100644
--- a/themes/default/product-list.tpl
+++ b/themes/default/product-list.tpl
@@ -58,9 +58,9 @@
 				{if ($product.id_product_attribute == 0 || (isset($add_prod_display) && ($add_prod_display == 1))) && $product.available_for_order && !isset($restricted_country_mode) && $product.minimal_quantity <= 1 && $product.customizable != 2 && !$PS_CATALOG_MODE}
 					{if ($product.allow_oosp || $product.quantity > 0)}
 						{if isset($static_token)}
-							<a class="button ajax_add_to_cart_button exclusive" rel="ajax_id_product_{$product.id_product|intval}" href="{$link->getPageLink('cart',false, NULL, "add&amp;id_product={$product.id_product|intval}&amp;token={$static_token}", true)}" title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
+							<a class="button ajax_add_to_cart_button exclusive" rel="ajax_id_product_{$product.id_product|intval}" href="{$link->getPageLink('cart',false, NULL, "add&amp;id_product={$product.id_product|intval}&amp;token={$static_token}", false)}" title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
 						{else}
-							<a class="button ajax_add_to_cart_button exclusive" rel="ajax_id_product_{$product.id_product|intval}" href="{$link->getPageLink('cart',false, NULL, "add&amp;id_product={$product.id_product|intval}", true)} title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
+							<a class="button ajax_add_to_cart_button exclusive" rel="ajax_id_product_{$product.id_product|intval}" href="{$link->getPageLink('cart',false, NULL, "add&amp;id_product={$product.id_product|intval}", false)} title="{l s='Add to cart'}"><span></span>{l s='Add to cart'}</a>
 						{/if}						
 					{else}
 						<span class="exclusive"><span></span>{l s='Add to cart'}</span><br />