Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
function getPurchaseProductList(saleid, saleRef) {

    /** Hide the customer purchase list */
    $("#showPurchaseList").hide();

    /** Show the purchase product list */
    $("#showPurchaseProductList").show();

    BMS.fn.get(`customerPurchaseProductList&saleid=${saleid}`, purchaseList => {
        
        var purchaseListHtml = "";
        purchaseList.forEach(item=> {

            purchaseListHtml += `<li style="cursor: pointer" 
                                    onClick="BMS.POS.addReturnProduct(
                                        '${item.pid}', 
                                        '${item.pn}', 
                                        '${item.pg}', 
                                        '${item.batch}', 
                                        '${item.pu}', 
                                        '${item.hed}',
                                        '${item.stock_item_discount}', 
                                        '${item.stock_item_price}', 
                                        '${item.stock_item_qty}', 
                                        '${item.stock_item_subtotal}'
                                    )" class="item">
                                    <a href="javascript:void(0)" class="product-title">${item.pn}
                                        <span style="font-size: 12px;" class="label label-success pull-right"> <i class="fa fa-undo"></i> </span>
                                        <span class="product-description">
                                            ${item.stock_item_qty}${(item.pu === null) ? "" : item.pu} @ ${to_money(item.stock_item_price)}
                                        </span>
                                    </a>
                                </li>`;

        });

        
        $(".saleReferenceShow").html(`<p style="font-size: 14px; font-weight: bold;">Product list for: ${saleRef}</p>`);
        $("#showPurchaseProductList ul").html(purchaseListHtml);

    });

}