From b0e130ef119a417afde97b3d009753b5b7e3d4a9 Mon Sep 17 00:00:00 2001
From: Julien BERNARD <jbernard@cofomo.com>
Date: Wed, 4 Sep 2024 09:04:24 -0400
Subject: [PATCH] Replace remaining get with post in delete endpoints

---
 .../templates/lgr_editor/codepoint_list.html  |  2 +-
 .../templates/lgr_editor/codepoint_view.html  | 29 +++++++++++---
 .../templates/lgr_editor/references.html      | 15 ++++---
 .../lgr_editor/templates/lgr_editor/tags.html | 15 ++++---
 .../lgr_editor/views/codepoints/codepoint.py  |  6 +--
 src/lgr_advanced/lgr_editor/views/create.py   |  3 +-
 .../lgr_editor/views/reference.py             |  2 +-
 src/lgr_advanced/lgr_editor/views/tag.py      |  2 +-
 .../templates/lgr_advanced/index.html         | 40 ++++++++++++-------
 .../icann_mode.html                           | 20 ++++++----
 .../list_reports.html                         | 22 +++++-----
 .../list_report_files.html                    | 20 ++++++----
 .../templates/lgr_models/_report_list.html    | 20 ++++++----
 src/lgr_session/views.py                      |  3 +-
 14 files changed, 120 insertions(+), 79 deletions(-)

diff --git a/src/lgr_advanced/lgr_editor/templates/lgr_editor/codepoint_list.html b/src/lgr_advanced/lgr_editor/templates/lgr_editor/codepoint_list.html
index 9a385e8b..2de63e49 100644
--- a/src/lgr_advanced/lgr_editor/templates/lgr_editor/codepoint_list.html
+++ b/src/lgr_advanced/lgr_editor/templates/lgr_editor/codepoint_list.html
@@ -185,7 +185,7 @@ <h4 class="modal-title">{% trans "Add code point(s)" %}</h4>
                             if (tmp_lgr) {
                                 let url = '{% url "delete_lgr" lgr_pk=42 %}'.replace('42', tmp_lgr);
                                 $.ajax({
-                                    type: "GET",
+                                    type: "POST",
                                     url: url
                                 });
                             }
diff --git a/src/lgr_advanced/lgr_editor/templates/lgr_editor/codepoint_view.html b/src/lgr_advanced/lgr_editor/templates/lgr_editor/codepoint_view.html
index 692b8eec..7f7889a6 100644
--- a/src/lgr_advanced/lgr_editor/templates/lgr_editor/codepoint_view.html
+++ b/src/lgr_advanced/lgr_editor/templates/lgr_editor/codepoint_view.html
@@ -8,6 +8,10 @@
     .tag-field .control-label {
         width: 100%;
     }
+    .btn-link:hover {
+        text-decoration: none;
+        color: #333;
+    }
 
     </style>
 {% endblock %}
@@ -94,7 +98,17 @@ <h3>Variants</h3>
                         {% if not is_set %}
                         <td>
                             <ul class="list-unstyled">
-                                <li><a class="btn btn-xs confirm-prompt" data-confirmation-prompt="{% trans 'Are you sure you want to delete this variant?' %}" href="{% url 'variant_delete' lgr_pk=lgr_pk codepoint_id=cp var_slug=char.to_slug %}">{% trans 'Delete variant' %}</a></li>
+                                <li>
+                                    <form method="post"
+                                          action="{% url 'variant_delete' lgr_pk=lgr_pk codepoint_id=cp var_slug=char.to_slug %}">
+                                        {% csrf_token %}
+                                        <button type="submit"
+                                                class="btn btn-xs btn-link confirm-prompt"
+                                                data-confirmation-prompt="{% trans 'Are you sure you want to delete this variant?' %}">
+                                            {% trans 'Delete variant' %}
+                                        </button>
+                                    </form>
+                                </li>
                                 <li><a class="btn btn-xs btn-edit-var-refs" href="#" data-var-update-ref-url="{% url 'var_update_refs' lgr_pk=lgr_pk codepoint_id=cp var_slug=char.to_slug %}">{% trans 'Edit references' %}</a></li>
                             </ul>
                         </td>
@@ -156,10 +170,15 @@ <h3>References</h3>
 
     {% if not is_set %}
     <hr/>
-
-    <a class="btn btn-danger confirm-prompt" data-confirmation-prompt="{% trans 'Are you sure you want to delete this code point?' %}"
-       href="{% url 'codepoint_delete' lgr_pk=lgr_pk codepoint_id=cp %}">
-        <i class="glyphicon glyphicon-trash"></i> {% trans 'Delete code point' %}</a>
+        <form method="post"
+              action="{% url 'codepoint_delete' lgr_pk=lgr_pk codepoint_id=cp %}">
+            {% csrf_token %}
+            <button type="submit"
+                    class="btn btn-danger confirm-prompt"
+                    data-confirmation-prompt="{% trans 'Are you sure you want to delete this code point?' %}">
+                <i class="glyphicon glyphicon-trash"></i> {% trans 'Delete code point' %}
+            </button>
+        </form>
     {% endif %}
 
     <div class="modal" id="reference-editor">
diff --git a/src/lgr_advanced/lgr_editor/templates/lgr_editor/references.html b/src/lgr_advanced/lgr_editor/templates/lgr_editor/references.html
index 365fe278..75154fe2 100644
--- a/src/lgr_advanced/lgr_editor/templates/lgr_editor/references.html
+++ b/src/lgr_advanced/lgr_editor/templates/lgr_editor/references.html
@@ -24,12 +24,15 @@ <h3>{% trans 'Existing references' %}</h3>
                         <td class="ref-comment">{% include "lgr_editor/_form_field_no_label.html" with field=ref.comment %}</td>
                         {% if not is_set %}
                         <td class="text-right">
-                            <a class="btn btn-default confirm-prompt"
-                               title="{% trans 'Delete reference' %}"
-                               data-confirmation-prompt="{% trans 'Are you sure you want to delete this reference?' %}"
-                               href="{% url 'reference_delete' lgr_pk=lgr_pk ref_id=ref.ref_id.value %}">
-                                <i class="glyphicon glyphicon-trash"></i>
-                            </a>
+                            <form method="post"
+                                  action="{% url 'reference_delete' lgr_pk=lgr_pk ref_id=ref.ref_id.value %}">
+                                {% csrf_token %}
+                                <button type="submit"
+                                        class="btn btn-default confirm-prompt"
+                               data-confirmation-prompt="{% trans 'Are you sure you want to delete this reference?' %}">
+                                    <i class="glyphicon glyphicon-trash"></i>
+                                </button>
+                            </form>
                         </td>
                         {% endif %}
                     </tr>
diff --git a/src/lgr_advanced/lgr_editor/templates/lgr_editor/tags.html b/src/lgr_advanced/lgr_editor/templates/lgr_editor/tags.html
index 8d259b3d..03b029ac 100644
--- a/src/lgr_advanced/lgr_editor/templates/lgr_editor/tags.html
+++ b/src/lgr_advanced/lgr_editor/templates/lgr_editor/tags.html
@@ -44,12 +44,15 @@ <h3>{% trans 'Existing tags' %}</h3>
                     </td>
                     {% if not is_set %}
                     <td class="text-right">
-                        <a class="btn btn-default confirm-prompt"
-                           title="{% trans 'Delete Tag' %}"
-                           data-confirmation-prompt="{% blocktrans with tag=tag.name %}Are you sure you want to delete tag {{ tag }}?{% endblocktrans %}"
-                           href="{% url 'tag_delete' lgr_pk=lgr_pk tag_id=tag.name %}">
-                            <i class="glyphicon glyphicon-trash"></i>
-                        </a>
+                        <form method="post"
+                              action="{% url 'tag_delete' lgr_pk=lgr_pk tag_id=tag.name %}">
+                            {% csrf_token %}
+                            <button type="submit"
+                                    class="btn btn-default confirm-prompt"
+                           data-confirmation-prompt="{% blocktrans with tag=tag.name %}Are you sure you want to delete tag {{ tag }}?{% endblocktrans %}">
+                                <i class="glyphicon glyphicon-trash"></i>
+                            </button>
+                        </form>
                     </td>
                     {% endif %}
                 </tr>
diff --git a/src/lgr_advanced/lgr_editor/views/codepoints/codepoint.py b/src/lgr_advanced/lgr_editor/views/codepoints/codepoint.py
index 011208d2..d12bfdba 100644
--- a/src/lgr_advanced/lgr_editor/views/codepoints/codepoint.py
+++ b/src/lgr_advanced/lgr_editor/views/codepoints/codepoint.py
@@ -380,8 +380,7 @@ class CodePointDeleteView(LGREditMixin, CodePointMixin, View):
     Delete a codepoint from an LGR.
     """
 
-    # TODO - only accept POST request
-    def get(self, request, *args, **kwargs):
+    def post(self, request, *args, **kwargs):
         char = self.lgr.get_char(self.codepoint)
 
         try:
@@ -403,8 +402,7 @@ class VariantDeleteView(LGREditMixin, CodePointMixin, View):
     Delete a variant of a codepoint from an LGR.
     """
 
-    # TODO - only accept POST request
-    def get(self, request, *args, **kwargs):
+    def post(self, request, *args, **kwargs):
         var_slug = self.kwargs['var_slug']
         var_cp, var_when, var_not_when = slug_to_var(var_slug)
 
diff --git a/src/lgr_advanced/lgr_editor/views/create.py b/src/lgr_advanced/lgr_editor/views/create.py
index 80379df0..f9bb71d3 100644
--- a/src/lgr_advanced/lgr_editor/views/create.py
+++ b/src/lgr_advanced/lgr_editor/views/create.py
@@ -223,7 +223,6 @@ def setup(self, request, *args, **kwargs):
         super().setup(request, *args, **kwargs)
         self.lgr_pk = self.kwargs['lgr_pk']
 
-    # TODO make that a post
-    def get(self, request, *args, **kwargs):
+    def post(self, request, *args, **kwargs):
         LgrModel.get_object(request.user, self.lgr_pk).delete()
         return redirect('lgr_advanced_mode')
diff --git a/src/lgr_advanced/lgr_editor/views/reference.py b/src/lgr_advanced/lgr_editor/views/reference.py
index c81fbcaa..5419439c 100644
--- a/src/lgr_advanced/lgr_editor/views/reference.py
+++ b/src/lgr_advanced/lgr_editor/views/reference.py
@@ -185,7 +185,7 @@ class DeleteReferenceView(LGREditMixin, View):
     Delete a reference from an LGR.
     """
 
-    def get(self, request, *args, **kwargs):
+    def post(self, request, *args, **kwargs):
         ref_id = self.kwargs['ref_id']
         logger.debug("Delete reference %s'", ref_id)
 
diff --git a/src/lgr_advanced/lgr_editor/views/tag.py b/src/lgr_advanced/lgr_editor/views/tag.py
index 4225086a..d6ca31a3 100644
--- a/src/lgr_advanced/lgr_editor/views/tag.py
+++ b/src/lgr_advanced/lgr_editor/views/tag.py
@@ -90,7 +90,7 @@ class DeleteTagView(LGREditMixin, View):
     Delete a tag from an LGR.
     """
 
-    def get(self, request, *args, **kwargs):
+    def post(self, request, *args, **kwargs):
         tag_id = self.kwargs['tag_id']
         logger.debug("Delete tag %s'", tag_id)
 
diff --git a/src/lgr_advanced/templates/lgr_advanced/index.html b/src/lgr_advanced/templates/lgr_advanced/index.html
index 70ca6d95..6aec3d5c 100644
--- a/src/lgr_advanced/templates/lgr_advanced/index.html
+++ b/src/lgr_advanced/templates/lgr_advanced/index.html
@@ -34,13 +34,18 @@ <h4>{% trans "LGRs" %}</h4>
                     <ul>
                         {% for lgr in local_lgrs.list %}
                             <li>
-                                <a href="{% url 'codepoint_list' lgr_pk=lgr.pk model=lgr.model_name %}">
-                                    {% blocktrans with lgr_name=lgr.name %}View {{ lgr_name }}{% endblocktrans %}
-                                </a>
-                                <a href="{% url 'delete_lgr' lgr.pk %}" class="delete_lgr confirm-prompt"
-                                   data-confirmation-prompt="{% blocktrans with lgr_name=lgr.name %}Are you sure you want to delete LGR {{ lgr_name }}?{% endblocktrans %}">
-                                    <i class="glyphicon glyphicon-trash"></i>
-                                </a>
+                                <form method="post"
+                                      action="{% url 'delete_lgr' lgr.pk %}">
+                                    {% csrf_token %}
+                                    <a href="{% url 'codepoint_list' lgr_pk=lgr.pk model=lgr.model_name %}">
+                                        {% blocktrans with lgr_name=lgr.name %}View {{ lgr_name }}{% endblocktrans %}
+                                    </a>
+                                    <button type="submit"
+                                            class="delete_lgr confirm-prompt btn-link"
+                                            data-confirmation-prompt="{% blocktrans with lgr_name=lgr.name %}Are you sure you want to delete LGR {{ lgr_name }}?{% endblocktrans %}">
+                                        <i class="glyphicon glyphicon-trash"></i>
+                                    </button>
+                                </form>
                             </li>
                         {% endfor %}
                     </ul>
@@ -49,14 +54,19 @@ <h4>{% trans "LGR sets" %}</h4>
                     <ul>
                         {% for lgr in local_lgrs.list %}
                             <li>
-                                <a href="{% url 'codepoint_list' lgr_pk=lgr.pk model=lgr.model_name %}">
-                                    {% blocktrans with lgr_name=lgr.name %}View {{ lgr_name }}{% endblocktrans %}
-                                </a>
-                                <a href="#{{lgr.name}}" data-toggle="collapse" class="btn btn-default btn-sm"><i class="glyphicon glyphicon-th-list"></i>&nbsp;{% blocktrans %}View embedded LGRs{% endblocktrans %}</a>
-                                <a href="{% url 'delete_lgr' lgr.pk %}" class="delete_lgr confirm-prompt"
-                                   data-confirmation-prompt="{% blocktrans with lgr_name=lgr.name %}Are you sure you want to delete LGR {{ lgr_name }}?{% endblocktrans %}">
-                                    <i class="glyphicon glyphicon-trash"></i>
-                                </a>
+                                <form method="post"
+                                      action="{% url 'delete_lgr' lgr.pk %}">
+                                    {% csrf_token %}
+                                    <a href="{% url 'codepoint_list' lgr_pk=lgr.pk model=lgr.model_name %}">
+                                        {% blocktrans with lgr_name=lgr.name %}View {{ lgr_name }}{% endblocktrans %}
+                                    </a>
+                                    <a href="#{{lgr.name}}" data-toggle="collapse" class="btn btn-default btn-sm"><i class="glyphicon glyphicon-th-list"></i>&nbsp;{% blocktrans %}View embedded LGRs{% endblocktrans %}</a>
+                                    <button type="submit"
+                                            class="delete_lgr confirm-prompt btn-link"
+                                            data-confirmation-prompt="{% blocktrans with lgr_name=lgr.name %}Are you sure you want to delete LGR {{ lgr_name }}?{% endblocktrans %}">
+                                        <i class="glyphicon glyphicon-trash"></i>
+                                    </button>
+                                </form>
                             </li>
 
                             <div class="panel-group">
diff --git a/src/lgr_idn_table_review/icann_tools/templates/lgr_idn_table_review_icann/icann_mode.html b/src/lgr_idn_table_review/icann_tools/templates/lgr_idn_table_review_icann/icann_mode.html
index 185bf7ad..97e5d97f 100644
--- a/src/lgr_idn_table_review/icann_tools/templates/lgr_idn_table_review_icann/icann_mode.html
+++ b/src/lgr_idn_table_review/icann_tools/templates/lgr_idn_table_review_icann/icann_mode.html
@@ -33,14 +33,18 @@ <h2>
         {% for reports_grouped in report_ids %}
             {% with report=reports_grouped.list|first %}
                 <li>
-                    <a href="{% url 'lgr_idn_icann_reports' report_id=report.report_id %}">
-                        {% blocktrans with report.report_id as report_id %}{{ report_id }}{% endblocktrans %}
-                    </a>
-                    <a href="{% url 'delete_report_file' storage=report.storage report_id=report.report_id %}?next={{ request.path }}"
-                       class="delete_report confirm-prompt"
-                       data-confirmation-prompt="{% blocktrans with report.report_id as report_id %}Are you sure you want to delete report {{ report_id }}?{% endblocktrans %}">
-                        <i class="glyphicon glyphicon-trash"></i>
-                    </a>
+                    <form method="post"
+                          action="{% url 'delete_report_file' storage=report.storage report_id=report.report_id %}?next={{ request.path }}">
+                        {% csrf_token %}
+                        <a href="{% url 'lgr_idn_icann_reports' report_id=report.report_id %}">
+                            {% blocktrans with report.report_id as report_id %}{{ report_id }}{% endblocktrans %}
+                        </a>
+                        <button type="submit"
+                                class="delete_report confirm-prompt"
+                                data-confirmation-prompt="{% blocktrans with report.report_id as report_id %}Are you sure you want to delete report {{ report_id }}?{% endblocktrans %}">
+                            <i class="glyphicon glyphicon-trash"></i>
+                        </button>
+                    </form>
                 </li>
             {% endwith %}
         {% empty %}
diff --git a/src/lgr_idn_table_review/idn_tool/templates/lgr_idn_table_review_tool/list_reports.html b/src/lgr_idn_table_review/idn_tool/templates/lgr_idn_table_review_tool/list_reports.html
index d615084b..33a4df0f 100644
--- a/src/lgr_idn_table_review/idn_tool/templates/lgr_idn_table_review_tool/list_reports.html
+++ b/src/lgr_idn_table_review/idn_tool/templates/lgr_idn_table_review_tool/list_reports.html
@@ -21,18 +21,16 @@
             <li>
               {% with report=reports_grouped.list|first %}
                 {% with report_id=report.report_id %}
-                  <form id="form-delete-{{ forloop.counter }}" method="post"
-                        action="{% url "lgr_review_delete_report" report_id=report_id %}?next={{ request.path }}">
-                    {% csrf_token %}
-                  </form>
-                  <a href="{% url 'lgr_review_report' report_id %}">{{ report_id }}</a>
-                  <a href="#"
-                     class="delete_report confirm-prompt"
-                     data-confirmation-prompt="{% blocktrans %}Are you sure you want to delete report {{ report_id }}?{% endblocktrans %}"
-                     data-confirmation-action="$('#form-delete-{{ forloop.counter }}').submit()">
-                    <i class="glyphicon glyphicon-trash"></i>
-                  </a>
-                  <small>{{ report|display_expiration }}</small>
+                    <form method="post" action="{% url "lgr_review_delete_report" report_id=report_id %}?next={{ request.path }}">
+                        {% csrf_token %}
+                        <a href="{% url 'lgr_review_report' report_id %}">{{ report_id }}</a>
+                        <button type="submit"
+                                class="delete_report confirm-prompt btn-link"
+                                data-confirmation-prompt="{% blocktrans %}Are you sure you want to delete report {{ report_id }}?{% endblocktrans %}">
+                            <i class="glyphicon glyphicon-trash"></i>
+                        </button>
+                        <small>{{ report|display_expiration }}</small>
+                    </form>
                 {% endwith %}
               {% endwith %}
             </li>
diff --git a/src/lgr_idn_table_review/templates/lgr_idn_table_review/list_report_files.html b/src/lgr_idn_table_review/templates/lgr_idn_table_review/list_report_files.html
index e037fd2b..b789ddf5 100644
--- a/src/lgr_idn_table_review/templates/lgr_idn_table_review/list_report_files.html
+++ b/src/lgr_idn_table_review/templates/lgr_idn_table_review/list_report_files.html
@@ -37,14 +37,18 @@
                     {% endif %}
                 </td>
                 <td>
-                    <a href="{{ report.to_url }}" class="btn btn-default">
-                        <i class="glyphicon glyphicon-floppy-disk"></i>
-                    </a>
-                    <a href="{{ report.delete_url }}?next={{ request.path }}"
-                       class="delete_report btn btn-default confirm-prompt"
-                       data-confirmation-prompt="{% blocktrans %}Are you sure you want to delete report {{ report.filename }}?{% endblocktrans %}">
-                        <i class="glyphicon glyphicon-trash"></i>
-                    </a>
+                    <form method="post"
+                          action="{{ report.delete_url }}?next={{ request.path }}">
+                        {% csrf_token %}
+                        <a href="{{ report.to_url }}" class="btn btn-default">
+                            <i class="glyphicon glyphicon-floppy-disk"></i>
+                        </a>
+                        <button type="submit"
+                                class="delete_report btn btn-default confirm-prompt"
+                                data-confirmation-prompt="{% blocktrans %}Are you sure you want to delete report {{ report.filename }}?{% endblocktrans %}">
+                            <i class="glyphicon glyphicon-trash"></i>
+                        </button>
+                    </form>
                 </td>
             </tr>
         {% endfor %}
diff --git a/src/lgr_models/templates/lgr_models/_report_list.html b/src/lgr_models/templates/lgr_models/_report_list.html
index 675bffd8..fa51cc05 100644
--- a/src/lgr_models/templates/lgr_models/_report_list.html
+++ b/src/lgr_models/templates/lgr_models/_report_list.html
@@ -5,14 +5,18 @@
     <ul>
         {% for report in reports %}
             <li>
-                <a href="{{ report.to_url }}">
-                    {% trans 'Download' %} {{ report.filename }}
-                </a>
-                <a href="{{ report.delete_url }}?next={{ request.path }}"
-                   data-confirmation-prompt="{% blocktrans %}Are you sure you want to delete report {{ report.filename }}?{% endblocktrans %}"
-                   class="delete_report confirm-prompt">
-                    <i class="glyphicon glyphicon-trash"></i>
-                </a>
+                <form method="post"
+                      action="{{ report.delete_url }}?next={{ request.path }}">
+                    {% csrf_token %}
+                    <a href="{{ report.to_url }}">
+                        {% trans 'Download' %} {{ report.filename }}
+                    </a>
+                    <button type="submit"
+                            class="delete_report confirm-prompt btn-link"
+                            data-confirmation-prompt="{% blocktrans %}Are you sure you want to delete report {{ report.filename }}?{% endblocktrans %}">
+                        <i class="glyphicon glyphicon-trash"></i>
+                    </button>
+                </form>
                 <small>{{ report|display_expiration }}</small>
             </li>
         {% endfor %}
diff --git a/src/lgr_session/views.py b/src/lgr_session/views.py
index bbf91ebd..36af540b 100644
--- a/src/lgr_session/views.py
+++ b/src/lgr_session/views.py
@@ -56,8 +56,7 @@ def get(self, request, *args, **kwargs):
 
 class DeleteReportFileView(LGRSessionView):
 
-    # TODO make that a post
-    def get(self, request, *args, **kwargs):
+    def post(self, request, *args, **kwargs):
         if self.pk:
             self.session.storage_delete_report_file(self.pk)
         if self.report_id: