finnandClaude Opus 5.5
91eaef7f93
Five templates built their form action with url_for(..., **request.args), so every query parameter ended up in the action. This included Flask's special parameters (?_external=1 gave an absolute http:// action in production) and the route parameters (?user_id=... or ?alias_id=... caused a TypeError and HTTP 500). The only parameter needed is return=detail, which sends the user back to the detail page after the POST. ReturnToMixin reads it, passes on only the known value and puts it into the template context as return_to. BackToUsersMixin and BackToAliasesMixin build on it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
12 lines
459 B
HTML
12 lines
459 B
HTML
{% extends "base.html" %}
|
|
{% block content %}
|
|
<h1>{{ t("Delete {user}?", user=user.email) }}</h1>
|
|
|
|
{% include "alerts.html" %}
|
|
|
|
<form action="{{ url_for('user-delete', user_id=user.id, return=return_to) }}" method="post">
|
|
<button type="submit" class="pure-button button-error">{{ t("Delete") }}</button>
|
|
<a href="{{ back_url }}" class="pure-button">{{ t("Cancel") }}</a>
|
|
{% include "csrf.html" %}
|
|
</form>
|
|
{% endblock %} |