From c1dab445961f084181dd19224b9c6a13204ecd16 Mon Sep 17 00:00:00 2001 From: "Christopher C. Wells" Date: Sat, 31 Jul 2021 13:56:48 -0700 Subject: [PATCH] Use POST for timer quick add functionality --- babybuddy/templates/babybuddy/nav-dropdown.html | 12 +++++++++--- core/templates/core/timer_nav.html | 11 ++++++++--- core/tests/tests_views.py | 4 +++- core/views.py | 3 ++- 4 files changed, 22 insertions(+), 8 deletions(-) diff --git a/babybuddy/templates/babybuddy/nav-dropdown.html b/babybuddy/templates/babybuddy/nav-dropdown.html index 14f02aa38..1cc77d7b3 100644 --- a/babybuddy/templates/babybuddy/nav-dropdown.html +++ b/babybuddy/templates/babybuddy/nav-dropdown.html @@ -8,9 +8,15 @@ Baby Buddy -
- -
+
+
+ {% csrf_token %} + + +
+
{% if perms.core.add_timer %} - - {% trans "Quick Start Timer" %} - +
+
+ {% csrf_token %} + +
+
{% trans "Start Timer" %} diff --git a/core/tests/tests_views.py b/core/tests/tests_views.py index 07852dd93..75089962b 100644 --- a/core/tests/tests_views.py +++ b/core/tests/tests_views.py @@ -115,7 +115,9 @@ def test_timer_views(self): page = self.c.get('/timers/add/') self.assertEqual(page.status_code, 200) - page = self.c.get('/timers/add/quick/', follow=True) + page = self.c.get('/timers/add/quick/') + self.assertEqual(page.status_code, 405) + page = self.c.post('/timers/add/quick/', follow=True) self.assertEqual(page.status_code, 200) entry = models.Timer.objects.first() diff --git a/core/views.py b/core/views.py index 0ecfa66db..f5788d462 100644 --- a/core/views.py +++ b/core/views.py @@ -310,9 +310,10 @@ def get_success_url(self): class TimerAddQuick(PermissionRequired403Mixin, RedirectView): + http_method_names = ['post'] permission_required = ('core.add_timer',) - def get(self, request, *args, **kwargs): + def post(self, request, *args, **kwargs): instance = models.Timer.objects.create(user=request.user) # Add child relationship if there is only Child instance. if models.Child.count() == 1: