spree_wishlist
spree_wishlist copied to clipboard
spree-contrib
Wishlist extension for Spree Commerce.
When I remove product from wishlist via ajax request something like this: `$.ajax('/wished_products/14', {method: 'delete'})` in controller action we can see that after removing item redirects to the current withlist...
Like the title says. On my product page there is a button with code: ``` @product.master.id %> ``` When I am signed in and click the Add to Wishlist button...
That's right, anonymous users can edit and delete other people's wishlists, just by having the right URL. No permission checks are performed.
