From 0d811d067c8e064252c0143c39d6cd4c3133679e Mon Sep 17 00:00:00 2001
From: snipe <snipe@snipe.net>
Date: Fri, 5 Nov 2021 10:53:48 -0700
Subject: [PATCH] Turn cusotm fields required/optional/remove into POST
 requests

Signed-off-by: snipe <snipe@snipe.net>
---
 .../custom_fields/fieldsets/view.blade.php    | 25 ++++++++++++-------
 routes/web/fields.php                         |  6 ++---
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/resources/views/custom_fields/fieldsets/view.blade.php b/resources/views/custom_fields/fieldsets/view.blade.php
index d0a42f6c74b5..8a712e2af625 100644
--- a/resources/views/custom_fields/fieldsets/view.blade.php
+++ b/resources/views/custom_fields/fieldsets/view.blade.php
@@ -57,21 +57,28 @@
               <td>{{$field->element}}</td>
               <td>{{ $field->field_encrypted=='1' ?  trans('general.yes') : trans('general.no') }}</td>
                 <td>
+                  
                     @if ($field->pivot->required)
-                        <a href="{{ route('fields.optional', [$custom_fieldset->id, $field->id]) }}">
-                            <i class="fa fa-check text-success" aria-hidden="true"></i>
-                            <span class="sr-only">Required - click to make optional</span>
-                        </a>
+                    <form method="post" action="{{ route('fields.optional', [$custom_fieldset->id, $field->id]) }}">
+                      @csrf 
+                      <button type="submit" class="btn btn-link"><i class="fa fa-check text-success" aria-hidden="true"></i></button>
+                      </form>
+
                     @else
-                        <a href="{{ route('fields.required', [$custom_fieldset->id, $field->id]) }}">
-                            <i class="fa fa-times text-danger" aria-hidden="true"></i>
-                            <span class="sr-only">Optional - click to make required</span>
-                        </a>
+
+                      <form method="post" action="{{ route('fields.required', [$custom_fieldset->id, $field->id]) }}">
+                      @csrf 
+                      <button type="submit" class="btn btn-link"><i class="fa fa-times text-danger" aria-hidden="true"></i></button>
+                      </form>
                     @endif
+                    
                 </td>
               <td>
                 @can('update', $custom_fieldset)
-                <a href="{{ route('fields.disassociate', [$field, $custom_fieldset->id]) }}" class="btn btn-sm btn-danger">Remove</a>
+                <form method="post" action="{{ route('fields.disassociate', [$field, $custom_fieldset->id]) }}">
+                  @csrf 
+                  <button type="submit" class="btn btn-sm btn-danger">Remove</button>
+                </form>
                 @endcan
               </td>
             </tr>
diff --git a/routes/web/fields.php b/routes/web/fields.php
index a2fedcfd9339..aedaa46bd7d2 100644
--- a/routes/web/fields.php
+++ b/routes/web/fields.php
@@ -7,17 +7,17 @@
 
 Route::group([ 'prefix' => 'fields','middleware' => ['auth'] ], function () {
 
-    Route::get('required/{fieldset_id}/{field_id}',
+    Route::post('required/{fieldset_id}/{field_id}',
         ['uses' => 'CustomFieldsetsController@makeFieldRequired',
             'as' => 'fields.required']
     );
 
-    Route::get('optional/{fieldset_id}/{field_id}',
+    Route::post('optional/{fieldset_id}/{field_id}',
         ['uses' => 'CustomFieldsetsController@makeFieldOptional',
             'as' => 'fields.optional']
     );
 
-    Route::get('{field_id}/fieldset/{fieldset_id}/disassociate',
+    Route::post('{field_id}/fieldset/{fieldset_id}/disassociate',
         ['uses' => 'CustomFieldsController@deleteFieldFromFieldset',
         'as' => 'fields.disassociate']
     );