Use POST for timer quick add functionality

babybuddy · Jul 31, 2021 · c1dab44 · c1dab44
1 parent 824d2af
commit c1dab44
Show file tree

Hide file tree

Showing 4 changed files with 22 additions and 8 deletions.
diff --git a/babybuddy/templates/babybuddy/nav-dropdown.html b/babybuddy/templates/babybuddy/nav-dropdown.html
@@ -8,9 +8,15 @@
             <span class="text-primary">Baby</span> Buddy
         </a>
 
-        <div class="d-lg-none d-md-none ml-auto p-0 mr-2">
-            <a class="text-success mr-2" href="{% url 'core:timer-add-quick' %}"><i class="icon icon-2x icon-timer" aria-hidden="true"></i></a>
-            <div class="dropdown show d-inline">
+        <div class="d-lg-none d-md-none d-flex ml-auto p-0 mr-2">
+            <form action="{% url 'core:timer-add-quick' %}" role="form" method="post" class="mr-2">
+                {% csrf_token %}
+                <label class="sr-only">{% trans "Quick Start Timer" %}</label>
+                <button class="btn m-0 p-0 text-success">
+                    <i class="icon icon-2x icon-timer" aria-hidden="true"></i>
+                </button>
+            </form>
+            <div class="dropdown show">
                 <a class="text-success"
                    href="#"
                    role="button"

diff --git a/core/templates/core/timer_nav.html b/core/templates/core/timer_nav.html
@@ -11,9 +11,14 @@
     </a>
     <div class="dropdown-menu" aria-labelledby="nav-timer-menu-link">
         {% if perms.core.add_timer %}
-            <a class="dropdown-item" href="{% url 'core:timer-add-quick' %}">
-                <i class="icon icon-timer" aria-hidden="true"></i> {% trans "Quick Start Timer" %}
-            </a>
+            <div class="dropdown-item">
+                <form action="{% url 'core:timer-add-quick' %}" role="form" method="post" class="d-inline">
+                    {% csrf_token %}
+                    <button class="btn text-left p-0">
+                        <i class="icon icon-timer" aria-hidden="true"></i> {% trans "Quick Start Timer" %}
+                    </button>
+                </form>
+            </div>
             <a class="dropdown-item" href="{% url 'core:timer-add' %}">
                 <i class="icon icon-add" aria-hidden="true"></i> {% trans "Start Timer" %}
             </a>

diff --git a/core/tests/tests_views.py b/core/tests/tests_views.py
@@ -115,7 +115,9 @@ def test_timer_views(self):
         page = self.c.get('/timers/add/')
         self.assertEqual(page.status_code, 200)
 
-        page = self.c.get('/timers/add/quick/', follow=True)
+        page = self.c.get('/timers/add/quick/')
+        self.assertEqual(page.status_code, 405)
+        page = self.c.post('/timers/add/quick/', follow=True)
         self.assertEqual(page.status_code, 200)
 
         entry = models.Timer.objects.first()

diff --git a/core/views.py b/core/views.py
@@ -310,9 +310,10 @@ def get_success_url(self):
 
 
 class TimerAddQuick(PermissionRequired403Mixin, RedirectView):
+    http_method_names = ['post']
     permission_required = ('core.add_timer',)
 
-    def get(self, request, *args, **kwargs):
+    def post(self, request, *args, **kwargs):
         instance = models.Timer.objects.create(user=request.user)
         # Add child relationship if there is only Child instance.
         if models.Child.count() == 1: