nngo/LT_QR_Codes_Management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sep 16 - Optimize code, part 1

Browse Source
This commit is contained in:
nngo
2026-09-16 10:52:59 -04:00
parent 4212726611
commit 7626287344
22 changed files with 587 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/users.html
+32 -14
View File
@@ -289,27 +289,33 @@ Code Management{% endblock %} {% block extra_head %}
{% if user.role != 'admin' %}
<!-- Promote to Admin -->
<a
href="{{ url_for('users.promote_user', user_id=user.id) }}"
class="btn btn-sm btn-success"
title="Promote to Admin"
onclick="return confirm('Are you sure you want to promote {{ user.full_name }} to admin?')"
<form
method="POST"
action="{{ url_for('users.promote_user', user_id=user.id) }}"
style="display: inline; margin: 0;"
data-confirm="Are you sure you want to promote {{ user.full_name }} to admin?"
>
<i class="fas fa-arrow-up"></i>
</a>
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
<button type="submit" class="btn btn-sm btn-success" title="Promote to Admin">
<i class="fas fa-arrow-up"></i>
</button>
</form>
{% else %}
<!-- Demote from Admin -->
{% if users|selectattr('role', 'equalto',
'admin')|selectattr('active_status', 'equalto', True)|list|length
> 1 %}
<a
href="{{ url_for('users.demote_user', user_id=user.id) }}"
class="btn btn-sm btn-warning"
title="Demote from Admin"
onclick="return confirm('Are you sure you want to demote {{ user.full_name }} from admin?')"
<form
method="POST"
action="{{ url_for('users.demote_user', user_id=user.id) }}"
style="display: inline; margin: 0;"
data-confirm="Are you sure you want to demote {{ user.full_name }} from admin?"
>
<i class="fas fa-arrow-down"></i>
</a>
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
<button type="submit" class="btn btn-sm btn-warning" title="Demote from Admin">
<i class="fas fa-arrow-down"></i>
</button>
</form>
{% else %}
<button
class="btn btn-sm btn-secondary"
@@ -426,6 +432,18 @@ Code Management{% endblock %} {% block extra_head %}
window.location.reload();
}
// Promote / demote are POST forms carrying the CSRF token (they used to be
// GET links, which a forged link could trigger). Confirm before submitting.
document.addEventListener("DOMContentLoaded", function () {
document.querySelectorAll("form[data-confirm]").forEach(function (form) {
form.addEventListener("submit", function (event) {
if (!confirm(form.dataset.confirm)) {
event.preventDefault();
}
});
});
});
function toggleUserStatus(userId, newStatus) {
const action = newStatus ? "activate" : "deactivate";
const message = `Are you sure you want to ${action} this user?`;