Avoid the onclick attribute in forms

In postman/view.html and in postman/base_folder.html, the action attribute is empty and set when a button is clicked with the onclick attribute. This method has two drawbacks:

the resulting HTML is invalid (the action attribute cannot be left empty)
nothing happens with a strong content security policy and messages cannot be deleted, archived or marked as read or unread.

A valid method is to set a name and a value attributes to the buttons, like this:

`

{% block pm_delete_button %}<button name="action" value="delete" type="submit" class="btn btn-sm btn-danger pm_btn pm_btn-delete" >{% trans "Delete" %}</button>{% endblock %}
{% block pm_archive_button %}<button name="action" value="archive" type="submit" class="btn btn-sm btn-primary pm_btn pm_btn-archive" >{% trans "Archive" %}</button>{% endblock %}
{% block pm_undelete_button %}<button name="action" value="undelete" type="submit" class="btn btn-sm btn-primary pm_btn pm_btn-undelete" >{% trans "Undelete" %}</button>{% endblock %}
{% block pm_read_button %}<button name="action" value="read" type="submit" class="btn btn-sm btn-primary pm_btn pm_btn-read" >{% trans "Mark as read" %}</button>{% endblock %}
{% block pm_unread_button %}<button name="action" value="unread" type="submit" class="btn btn-sm btn-primary pm_btn pm_btn-unread" >{% trans "Mark as unread" %}</button>{% endblock %}`

and to use the same view for all actions:

class MessageUpdateView(UpdateDualMixin, View):
    """View for updating messages or conversations.

    This single view replaces the following views: `ArchiveView`, `DeleteView`,
    `UndeleteView`, 'MarkReadView', 'MarkUnreadView'.
    This is required to avoid the onclick attribute in the template (forbidden by CSP).
    """

    @property
    def selected_action(self):
        """Get the action to perform on the selected messages or conversations."""
        action = self.request.POST.get("action")
        if action not in {"delete", "archive", "undelete", "read", "unread"}:
            raise PermissionDenied
        return action

    def _action(self, user: AbstractBaseUser, filter_: Q):
        """Perform the action on the selected messages or conversations."""
        if self.selected_action in {"read", "unread"}:
            Message.objects.as_recipient(user, filter_).filter(
                **{f"{self.field_bit}__isnull": bool(self.field_value)}
            ).update(**{self.field_bit: self.field_value})
        else:
            super()._action(user, filter_)
        # an empty set cannot be estimated as an error, it may be just a badly chosen selection

    @property
    def field_bit(self):
        """Get the field to update."""
        return {
            "delete": "deleted_at",
            "archive": "archived",
            "undelete": "deleted_at",
            "read": "read_at",
            "unread": "read_at",
        }[self.selected_action]

    @property
    def success_msg(self):
        """Get the success message to display."""
        return {
            "delete": _("Messages or conversations successfully deleted."),
            "archive": _("Messages or conversations successfully archived."),
            "undelete": _("Messages or conversations successfully recovered."),
            "read": _("Messages or conversations successfully marked as read."),
            "unread": _("Messages or conversations successfully marked as unread."),
        }[self.selected_action]

    @property
    def field_value(self):
        """Get the value to set the field to."""
        n = now()
        return {"delete": n, "archive": True, "undelete": None, "read": n, "unread": None}[self.selected_action]

‌

Comments (5)