Sep 16 - Optimize code, part 1

routes/users.py

@@ -201,7 +201,8 @@ def create_user():
         flash('Error loading form. Please try again.', 'error')
         return redirect(url_for('users.users'))
 
-@bp.route('/users/<int:user_id>/delete', methods=['GET', 'POST'], endpoint='delete_user')
+# POST only: a state change must carry a CSRF token — a GET link could be forged
+@bp.route('/users/<int:user_id>/delete', methods=['POST'], endpoint='delete_user')
 @admin_required
 def delete_user(user_id):
     """Deactivate user (Admin only) - Fixed with proper validation"""
@@ -242,7 +243,8 @@ def delete_user(user_id):
         flash('Error deactivating user. Please try again.', 'error')
         return redirect(url_for('users.users'))
 
-@bp.route('/users/<int:user_id>/reactivate', methods=['GET', 'POST'], endpoint='reactivate_user')
+# POST only: a state change must carry a CSRF token — a GET link could be forged
+@bp.route('/users/<int:user_id>/reactivate', methods=['POST'], endpoint='reactivate_user')
 @admin_required
 def reactivate_user(user_id):
     """Reactivate a deactivated user (Admin only)"""
@@ -272,7 +274,8 @@ def reactivate_user(user_id):
         flash('Error reactivating user. Please try again.', 'error')
         return redirect(url_for('users.users'))
 
-@bp.route('/users/<int:user_id>/promote', methods=['GET', 'POST'], endpoint='promote_user')
+# POST only: a state change must carry a CSRF token — a GET link could be forged
+@bp.route('/users/<int:user_id>/promote', methods=['POST'], endpoint='promote_user')
 @admin_required
 def promote_user(user_id):
     """Promote a staff user to admin (Admin only)"""
@@ -302,7 +305,8 @@ def promote_user(user_id):
         flash('Error promoting user. Please try again.', 'error')
         return redirect(url_for('users.users'))
 
-@bp.route('/users/<int:user_id>/demote', methods=['GET', 'POST'], endpoint='demote_user')
+# POST only: a state change must carry a CSRF token — a GET link could be forged
+@bp.route('/users/<int:user_id>/demote', methods=['POST'], endpoint='demote_user')
 @admin_required
 def demote_user(user_id):
     """Demote an admin user to staff (Admin only)"""
@@ -616,7 +620,8 @@ def toggle_user_status(user_id):
             'message': 'Error updating user status. Please try again.'
         }), 500
 
-@bp.route('/users/<int:user_id>/activate', methods=['GET', 'POST'], endpoint='activate_user')
+# POST only: a state change must carry a CSRF token — a GET link could be forged
+@bp.route('/users/<int:user_id>/activate', methods=['POST'], endpoint='activate_user')
 @admin_required
 def activate_user(user_id):
     """Activate a user (Admin only) - Alternative route"""
@@ -649,7 +654,8 @@ def activate_user(user_id):
         flash('Error activating user. Please try again.', 'error')
         return redirect(url_for('users.users'))
 
-@bp.route('/users/<int:user_id>/deactivate', methods=['GET', 'POST'], endpoint='deactivate_user')
+# POST only: a state change must carry a CSRF token — a GET link could be forged
+@bp.route('/users/<int:user_id>/deactivate', methods=['POST'], endpoint='deactivate_user')
 @admin_required
 def deactivate_user(user_id):
     """Deactivate a user (Admin only) - Alternative route"""
@@ -900,7 +906,8 @@ def reverse_geocode_api():
             'message': 'Internal server error during reverse geocoding. Please try again.'
         }), 500
 
-@bp.route('/users/<int:user_id>/permanently-delete', methods=['GET', 'POST'], endpoint='permanently_delete_user')
+# POST only: a state change must carry a CSRF token — a GET link could be forged
+@bp.route('/users/<int:user_id>/permanently-delete', methods=['POST'], endpoint='permanently_delete_user')
 @admin_required
 def permanently_delete_user(user_id):
     """Permanently delete user but preserve associated QR codes (Admin only)"""