From 6a9f7e0b0fa2141074a1eab26ec09137b22ee928 Mon Sep 17 00:00:00 2001
From: Nanne Baars <nanne.baars@owasp.org>
Date: Sat, 8 Apr 2017 11:25:24 +0200
Subject: [PATCH] Challenge 2: making elements on page work together

---
 .../owasp/webgoat/plugin/ShopEndpoint.java    |  6 ++--
 .../src/main/resources/html/Challenge.html    |  8 +++---
 .../src/main/resources/js/challenge2.js       | 28 +++++++++++++++----
 3 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/ShopEndpoint.java b/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/ShopEndpoint.java
index cc1f2bc3f..aae31c098 100644
--- a/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/ShopEndpoint.java
+++ b/webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/plugin/ShopEndpoint.java
@@ -44,9 +44,9 @@ public class ShopEndpoint {
 
     public ShopEndpoint() {
         List<CheckoutCode> codes = Lists.newArrayList();
-        codes.add(new CheckoutCode("pre-order-webgoat", 25));
-        codes.add(new CheckoutCode("pre-order-owasp", 25));
-        codes.add(new CheckoutCode("pre-order-webgoat-owasp", 50));
+        codes.add(new CheckoutCode("webgoat", 25));
+        codes.add(new CheckoutCode("owasp", 25));
+        codes.add(new CheckoutCode("owasp-webgoat", 50));
         this.checkoutCodes = new CheckoutCodes(codes);
     }
 
diff --git a/webgoat-lessons/challenge/src/main/resources/html/Challenge.html b/webgoat-lessons/challenge/src/main/resources/html/Challenge.html
index b937495a8..ee1e3363d 100644
--- a/webgoat-lessons/challenge/src/main/resources/html/Challenge.html
+++ b/webgoat-lessons/challenge/src/main/resources/html/Challenge.html
@@ -66,7 +66,7 @@
               action="/WebGoat/challenge/2"
               enctype="application/json;charset=UTF-8">
             <div class="container">
-
+                <input id="discount" type="hidden" value="0"/>
                 <div class="row">
                     <div class="col-xs-3 item-photo">
                         <img style="max-width:100%;" th:src="@{/images/samsung-black.jpg}"/>
@@ -117,7 +117,7 @@
                             </h6>
 
                             <!--
-                              Checkout code: pre-order-webgoat, pre-order-owasp, pre-order-webgoat-owasp
+                              Checkout code: webgoat, owasp, owasp-webgoat
                             -->
                             <input name="checkoutCode" class="checkoutCode" value=""/>
 
@@ -125,8 +125,8 @@
 
                         <div class="section" style="padding-bottom:20px;">
                             <button type="submit" class="btn btn-success"><span style="margin-right:20px"
-                                                                  class="glyphicon glyphicon-shopping-cart"
-                                                                  aria-hidden="true"></span>Buy
+                                                                                class="glyphicon glyphicon-shopping-cart"
+                                                                                aria-hidden="true"></span>Buy
                             </button>
                             <h6><a href="#"><span class="glyphicon glyphicon-heart-empty"
                                                   style="cursor:pointer;"></span>
diff --git a/webgoat-lessons/challenge/src/main/resources/js/challenge2.js b/webgoat-lessons/challenge/src/main/resources/js/challenge2.js
index eb1528c7c..78df37939 100644
--- a/webgoat-lessons/challenge/src/main/resources/js/challenge2.js
+++ b/webgoat-lessons/challenge/src/main/resources/js/challenge2.js
@@ -14,35 +14,51 @@ $(document).ready(function () {
 
     //-- Click on QUANTITY
     $(".btn-minus").on("click", function () {
-        var now = $(".section > div > input").val();
+        var now = $(".quantity").val();
         if ($.isNumeric(now)) {
             if (parseInt(now) - 1 > 0) {
                 now--;
             }
             $(".quantity").val(now);
+            $('#price').text(now * 899);
         } else {
             $(".quantity").val("1");
+            $('#price').text(899);
         }
+        calculate();
     })
     $(".btn-plus").on("click", function () {
-        var now = $(".section > div > input").val();
+        var now = $(".quantity").val();
         if ($.isNumeric(now)) {
             $(".quantity").val(parseInt(now) + 1);
         } else {
             $(".quantity").val("1");
         }
+        calculate();
     })
     $(".checkoutCode").on("blur", function () {
         var checkoutCode = $(".checkoutCode").val();
         $.get("challenge-store/coupons/" + checkoutCode, function (result, status) {
             var discount = result.discount;
             if (discount > 0) {
-                var price = $('#price').val();
-                $('#price').text((899 - (899 * discount / 100)).toFixed(2));
+                $('#discount').text(discount);
+                calculate();
             } else {
-                $('#price').text(899);
+                $('#discount').text(0);
+                calculate();
             }
-
         });
     })
+
+    function calculate() {
+        var d = $('#discount').text();
+        var price = $('#price').val();
+        var quantity = parseInt($(".quantity").val());
+        if (d > 0) {
+            $('#price').text((quantity * (899 - (899 * d / 100))).toFixed(2));
+
+        } else {
+            $('#price').text(quantity * 899);
+        }
+    }
 })
\ No newline at end of file