| @@ -1055,8 +1055,14 @@ | ||
| 1055 | 1055 | 'request_data' => $requestData |
| 1056 | 1056 | ]); |
| 1057 | 1057 | } |
| 1058 | 1058 | |
| 1059 | + // A locked cart may still take bumps through the accepts_additional_items | |
| 1060 | + // filter, but must never let an item it pinned be swapped out. | |
| 1061 | + if (Arr::get($checkoutData, 'is_locked') === 'yes') { | |
| 1062 | + return new \WP_Error('invalid_request', __('This cart is locked and cannot be modified.', 'fluent-cart')); | |
| 1063 | + } | |
| 1064 | + | |
| 1059 | 1065 | if (!$upgradeFromVariationId || !$targetVariationId) { |
| 1060 | 1066 | return new \WP_Error('invalid_request', __('Invalid upgrade request.', 'fluent-cart')); |
| 1061 | 1067 | } |
| 1062 | 1068 | |
