Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
            onClose: $("body").css('padding', '0px') // This is because, while close the sweet alert a 15px padding-right is keep.
        });
        return;
    }

    // Add loading icon in the button after click.
    $(submitter).html("Submit &nbsp;&nbsp; <i class='fa fa-spin fa-refresh'></i>");

    var formData = new FormData(this);       // Get all form data and store into formData 

    // Append the button value with form data
    formData.append(submitter.name, submitter.value);

    // disable submit button untile ajax request complete
    $("#payment").find("button").prop("disabled", true);

    $.ajax({
        url: full_website_address + "/info/?module=pos",
        type: "post",
        data: formData,
        cache: false,
        contentType: false,
        processData: false,
        success: function (data, status) {
            if (status == "success") {
                //Remove the loading icon from button
                $(submitter).html("Printing...");

                var saleStatus = JSON.parse(data);

                // Redirect to sale invoice print page
                if (saleStatus["saleStatus"] === "success") {

                    BMS.MAIN.printPage(full_website_address + "/invoice-print/?invoiceType=posSale&id=" + saleStatus["salesId"], event, function () {

                        // Hide the payment modal
                        $('#payment').modal('hide');

                        // Clear POS Screen
                        BMS.POS.clearScreen();

                        // enable submit button after ajax request complete
                        $("#payment").find("button").prop("disabled", false);

                    });

                } else {

                    $("#posErrorMsg").html('<div class="alert alert-danger">' + saleStatus["msg"] + '</div>');

                    // enable submit button after ajax request complete
                    $("#payment").find("button").prop("disabled", false);

                }

            }
        }
    });

});