Skip to content

F
flask-admin
Unverified Commit bf17b7ad authored by Serge S. Koval's avatar Serge S. Koval Committed by GitHub
Browse files
Options

Merge pull request #1788 from ufo911/master 

Fix Csrf Token Missing for file admin delete action
parents ca6ebad2 e9da9b29
Hide whitespace changes
Inline Side-by-side
Showing with 20 additions and 4 deletions
flask_admin/templates/bootstrap2/admin/file/list.html
View file @ bf17b7ad
...@@ -84,7 +84,11 @@ ...@@ -84,7 +84,11 @@
{% if name != '..' and admin_view.can_delete_dirs %} {% if name != '..' and admin_view.can_delete_dirs %}
<form class="icon" method="POST" action="{{ get_url('.delete') }}"> <form class="icon" method="POST" action="{{ get_url('.delete') }}">
{{ delete_form.path(value=path) }} {{ delete_form.path(value=path) }}
{{ delete_form.csrf_token }} {% if delete_form.csrf_token %}
{{ delete_form.csrf_token }}
{% elif csrf_token %}
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
{% endif %}
<button onclick="return confirm('{{ _gettext('Are you sure you want to delete \\\'%(name)s\\\' recursively?', name=name) }}')"> <button onclick="return confirm('{{ _gettext('Are you sure you want to delete \\\'%(name)s\\\' recursively?', name=name) }}')">
<i class="fa fa-times icon-remove"></i> <i class="fa fa-times icon-remove"></i>
</button> </button>
...@@ -93,7 +97,11 @@ ...@@ -93,7 +97,11 @@
{% else %} {% else %}
<form class="icon" method="POST" action="{{ get_url('.delete') }}"> <form class="icon" method="POST" action="{{ get_url('.delete') }}">
{{ delete_form.path(value=path) }} {{ delete_form.path(value=path) }}
{{ delete_form.csrf_token }} {% if delete_form.csrf_token %}
{{ delete_form.csrf_token }}
{% elif csrf_token %}
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
{% endif %}
<button onclick="return confirm('{{ _gettext('Are you sure you want to delete \\\'%(name)s\\\'?', name=name) }}')"> <button onclick="return confirm('{{ _gettext('Are you sure you want to delete \\\'%(name)s\\\'?', name=name) }}')">
<i class="fa fa-times icon-remove"></i> <i class="fa fa-times icon-remove"></i>
</button> </button>
......
flask_admin/templates/bootstrap3/admin/file/list.html
View file @ bf17b7ad
...@@ -84,7 +84,11 @@ ...@@ -84,7 +84,11 @@
{% if name != '..' and admin_view.can_delete_dirs %} {% if name != '..' and admin_view.can_delete_dirs %}
<form class="icon" method="POST" action="{{ get_url('.delete') }}"> <form class="icon" method="POST" action="{{ get_url('.delete') }}">
{{ delete_form.path(value=path) }} {{ delete_form.path(value=path) }}
{{ delete_form.csrf_token }} {% if delete_form.csrf_token %}
{{ delete_form.csrf_token }}
{% elif csrf_token %}
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
{% endif %}
<button onclick="return confirm('{{ _gettext('Are you sure you want to delete \\\'%(name)s\\\' recursively?', name=name) }}')"> <button onclick="return confirm('{{ _gettext('Are you sure you want to delete \\\'%(name)s\\\' recursively?', name=name) }}')">
<i class="fa fa-times glyphicon glyphicon-remove"></i> <i class="fa fa-times glyphicon glyphicon-remove"></i>
</button> </button>
...@@ -93,7 +97,11 @@ ...@@ -93,7 +97,11 @@
{% else %} {% else %}
<form class="icon" method="POST" action="{{ get_url('.delete') }}"> <form class="icon" method="POST" action="{{ get_url('.delete') }}">
{{ delete_form.path(value=path) }} {{ delete_form.path(value=path) }}
{{ delete_form.csrf_token }} {% if delete_form.csrf_token %}
{{ delete_form.csrf_token }}
{% elif csrf_token %}
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
{% endif %}
<button onclick="return confirm('{{ _gettext('Are you sure you want to delete \\\'%(name)s\\\'?', name=name) }}')"> <button onclick="return confirm('{{ _gettext('Are you sure you want to delete \\\'%(name)s\\\'?', name=name) }}')">
<i class="fa fa-trash glyphicon glyphicon-trash"></i> <i class="fa fa-trash glyphicon glyphicon-trash"></i>
</button> </button>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment