| @@ -1038,9 +1038,9 @@ | ||
| 1038 | 1038 | return new \WP_Error('no_cart', __('No active cart found', 'fluent-cart')); |
| 1039 | 1039 | } |
| 1040 | 1040 | |
| 1041 | 1041 | $checkoutData = $cart->checkout_data; |
| 1042 | - if (!empty($checkoutData['upgrade_data']) || !empty($checkoutData['is_locked'])) { | |
| 1042 | + if (!$cart->acceptsAdditionalItems()) { | |
| 1043 | 1043 | return new \WP_Error('invalid_request', __('This cart is locked or already has an upgrade applied.', 'fluent-cart')); |
| 1044 | 1044 | } |
| 1045 | 1045 | |
| 1046 | 1046 | $upgradeFromVariationId = (int) Arr::get($requestData, 'upgrade_form', 0); |
| @@ -1053,8 +1053,14 @@ | ||
| 1053 | 1053 | 'bump_id' => $bumpId, |
| 1054 | 1054 | 'cart' => $cart, |
| 1055 | 1055 | 'request_data' => $requestData |
| 1056 | 1056 | ]); |
| 1057 | + } | |
| 1058 | + | |
| 1059 | + // A locked cart may still take bumps through the accepts_additional_items | |
| 1060 | + // filter, but must never let an item it pinned be swapped out. | |
| 1061 | + if (Arr::get($checkoutData, 'is_locked') === 'yes') { | |
| 1062 | + return new \WP_Error('invalid_request', __('This cart is locked and cannot be modified.', 'fluent-cart')); | |
| 1057 | 1063 | } |
| 1058 | 1064 | |
| 1059 | 1065 | if (!$upgradeFromVariationId || !$targetVariationId) { |
| 1060 | 1066 | return new \WP_Error('invalid_request', __('Invalid upgrade request.', 'fluent-cart')); |
