Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
        success: function (data, status) {
            if (status == "success") {
                //Remove the loading icon from button
                $(submitter).html("Printing...");

                var saleStatus = JSON.parse(data);

                // Redirect to sale invoice print page
                if (saleStatus["saleStatus"] === "success") {

                    BMS.MAIN.printPage(full_website_address + "/invoice-print/?invoiceType=posSale&id=" + saleStatus["salesId"], event, function () {

                        // Hide the payment modal
                        $('#payment').modal('hide');

                        // Clear POS Screen
                        BMS.POS.clearScreen();

                        // enable submit button after ajax request complete
                        $("#payment").find("button").prop("disabled", false);

                    });

                } else {

                    $("#posErrorMsg").html('<div class="alert alert-danger">' + saleStatus["msg"] + '</div>');

                    // enable submit button after ajax request complete
                    $("#payment").find("button").prop("disabled", false);

                }

            }
        }