|
| 1 | +<!-- dollarId: user.item,v 1.7 2002/08/16 04:29:04 richard Exp dollar--> |
1 | 2 | <tal:block metal:use-macro="templates/page/macros/icing"> |
2 | 3 | <title metal:fill-slot="head_title" i18n:translate="" |
3 | 4 | >"Your Queries" Editing - <span tal:replace="config/TRACKER_NAME" |
4 | 5 | i18n:name="tracker" /></title> |
5 | 6 | <span metal:fill-slot="body_title" tal:omit-tag="python:1" |
6 | 7 | i18n:translate="">"Your Queries" Editing</span> |
7 | 8 |
|
8 | | -<td class="content" metal:fill-slot="content"> |
| 9 | +<td class="content" metal:fill-slot="content" |
| 10 | + tal:define="anti_csrf_this_page python:utils.anti_csrf_nonce()" > |
9 | 11 |
|
10 | 12 | <span tal:condition="not:context/is_edit_ok" |
11 | 13 | i18n:translate="">You are not allowed to edit queries.</span> |
12 | 14 |
|
13 | | -<script language="javascript"> |
14 | | -// This exists solely because I can't figure how to get the & into an |
15 | | -// attributes TALES expression, and so it keeps getting quoted. |
16 | | -function retire(qid) { |
17 | | - window.location = 'query'+qid+'?@action=retire&@template=edit'; |
| 15 | +<script tal:attributes="nonce request/client/client_nonce" |
| 16 | + language="javascript"> |
| 17 | +// This allows us to make the delete button an immediate action. |
| 18 | +// The post_to_url function comes from: |
| 19 | +// http://stackoverflow.com/questions/133925/javascript-post-request-like-a-form-submit |
| 20 | +function retire(qid, csrf) { |
| 21 | + post_to_url('query'+qid, {'@action': 'retire', '@template':'edit', |
| 22 | + '@csrf': csrf}); |
| 23 | +} |
| 24 | + |
| 25 | +function restore(qid, csrf) { |
| 26 | + post_to_url('query'+qid, {'@action': 'restore', '@template': 'edit', |
| 27 | + '@csrf': csrf}); |
| 28 | +} |
| 29 | +function post_to_url(path, params, method) { |
| 30 | + method = method || "post"; // Set method to post by default if not specified. |
| 31 | + |
| 32 | + var form = document.createElement("form"); |
| 33 | + form.setAttribute("method", method); |
| 34 | + form.setAttribute("action", path); |
| 35 | + |
| 36 | + for(var key in params) { |
| 37 | + if(params.hasOwnProperty(key)) { |
| 38 | + var hiddenField = document.createElement("input"); |
| 39 | + hiddenField.setAttribute("type", "hidden"); |
| 40 | + hiddenField.setAttribute("name", key); |
| 41 | + hiddenField.setAttribute("value", params[key]); |
| 42 | + |
| 43 | + form.appendChild(hiddenField); |
| 44 | + } |
| 45 | + } |
| 46 | + |
| 47 | + document.body.appendChild(form); |
| 48 | + form.submit(); |
18 | 49 | } |
19 | 50 | </script> |
20 | 51 |
|
|
28 | 59 | <th i18n:translate="">Include in "Your Queries"</th> |
29 | 60 | <th i18n:translate="">Edit</th> |
30 | 61 | <th i18n:translate="">Private to you?</th> |
31 | | - <th> </th> |
| 62 | + <th i18n:translate="">delete/restore<br> (javascript<br>required)</th> |
| 63 | +</tr> |
| 64 | +<tr> |
| 65 | + <td colspan="5"><b i18n:translate="">Queries I created</b></td> |
32 | 66 | </tr> |
33 | 67 |
|
34 | | -<tr tal:repeat="query mine"> |
35 | | - <tal:block condition="query/is_retired"> |
36 | | - |
| 68 | +<tr tal:define="queries python:db.query.filter(filterspec={'creator': uid})" |
| 69 | + tal:repeat="query queries"> |
| 70 | + <tal:block> |
37 | 71 | <td><a tal:attributes="href string:${query/klass}?${query/url}" |
38 | 72 | tal:content="query/name">query</a></td> |
39 | 73 |
|
|
50 | 84 | </select> |
51 | 85 | </td> |
52 | 86 |
|
53 | | - <td colspan="3" i18n:translate="">[query is retired]</td> |
54 | | - |
55 | | - <!-- <td> maybe offer "restore" some day </td> --> |
56 | | - </tal:block> |
57 | | -</tr> |
58 | | - |
59 | | -<tr tal:define="queries python:db.query.filter(filterspec={'private_for':uid})" |
60 | | - tal:repeat="query queries"> |
61 | | - <td><a tal:attributes="href string:${query/klass}?${query/url}" |
62 | | - tal:content="query/name">query</a></td> |
63 | | - |
64 | | - <td metal:use-macro="template/macros/include" /> |
65 | | - |
66 | 87 | <td><a tal:attributes="href string:query${query/id}" i18n:translate="">edit</a></td> |
67 | 88 |
|
68 | 89 | <td> |
69 | 90 | <select tal:attributes="name string:query${query/id}@private_for"> |
70 | 91 | <option tal:attributes="selected python:query.private_for == uid; |
71 | 92 | value uid" i18n:translate="">yes</option> |
72 | | - <option tal:attributes="selected python:query.private_for == None" |
| 93 | + <option tal:attributes="selected python:not query.private_for" |
73 | 94 | value="-1" i18n:translate="">no</option> |
74 | 95 | </select> |
75 | 96 | </td> |
76 | 97 |
|
77 | 98 | <td> |
78 | 99 | <input type="button" value="Delete" i18n:attributes="value" |
79 | | - tal:attributes="onClick python:'''retire('%s')'''%query.id"> |
| 100 | + tal:attributes="onClick python:'''retire('%s','%s')'''%(query.id,anti_csrf_this_page)"> |
80 | 101 | </td> |
| 102 | + </tal:block> |
| 103 | +</tr> |
| 104 | +<tr> |
| 105 | + <td colspan="4"><b i18n:translate="">Queries others created</b></td> |
| 106 | + <td colspan="4"><b i18n:translate="">Owner</b></td> |
81 | 107 | </tr> |
82 | 108 |
|
83 | | -<tr tal:define="queries python:db.query.filter(filterspec={'private_for':None})" |
| 109 | +<tr tal:define="queries |
| 110 | + python:db.query.filter(filterspec={'private_for': None})" |
84 | 111 | tal:repeat="query queries"> |
| 112 | + <tal:block tal:condition="python:not query.creator == uid"> |
85 | 113 | <td><a tal:attributes="href string:${query/klass}?${query/url}" |
86 | 114 | tal:content="query/name">query</a></td> |
87 | 115 |
|
88 | 116 | <td metal:use-macro="template/macros/include" /> |
89 | 117 |
|
90 | | - <td colspan="3" tal:condition="query/is_edit_ok"> |
91 | | - <a tal:attributes="href string:query${query/id}" i18n:translate="">edit</a> |
92 | | - </td> |
93 | | - <td tal:condition="not:query/is_edit_ok" colspan="3" |
| 118 | + <td colspan="2" tal:condition="not:query/is_edit_ok" |
94 | 119 | i18n:translate="">[not yours to edit]</td> |
95 | | - |
| 120 | + <td colspan="2" tal:condition="query/is_edit_ok" |
| 121 | + i18n:translate=""><a tal:attributes="href string:query${query/id}" i18n:translate="">edit</a></td> |
| 122 | + <td colspan="2" |
| 123 | + tal:content="query/creator" i18n:translate="">put query owner here</td> |
| 124 | + </tal:block> |
96 | 125 | </tr> |
97 | 126 |
|
| 127 | +<tr> |
| 128 | + <td colspan="5"><b i18n:translate="">Active retired/private queries</b></td> |
| 129 | +</tr> |
| 130 | +<tal:block tal:repeat="query request/user/queries"> |
| 131 | +<tr> |
| 132 | + <tal:block condition="python:path('query/is_retired')"> |
| 133 | + <td><a tal:attributes="href string:${query/klass}?${query/url}" |
| 134 | + tal:content="query/name">query</a></td> |
| 135 | + <tal:block tal:condition="python: not query.creator == uid"> |
| 136 | + <td metal:use-macro="template/macros/include"> </td> |
| 137 | + </tal:block> |
| 138 | + <td colspan="2" tal:condition="python: not query.creator == uid" i18n:translate="">[query is retired]</td> |
| 139 | + <td colspan="3" tal:condition="python: query.creator == uid" i18n:translate="">[query is retired]</td> |
| 140 | + <td tal:condition="python:query.creator == uid"> |
| 141 | + <input type="button" value="Restore" i18n:attributes="value" |
| 142 | + tal:attributes="onClick python:'''restore('%s','%s')'''%(query.id,anti_csrf_this_page)"> |
| 143 | + </td> |
| 144 | + <td colspan="1" tal:condition="python:not query.creator == uid" tal:content="query/creator" i18n:translate="">put query owner here</td> |
| 145 | + </tal:block> |
| 146 | +</tr> |
| 147 | +<tr> |
| 148 | + <tal:block condition="python:path('query/private_for') and (not query.creator == uid)"> |
| 149 | + <td><a tal:attributes="href string:${query/klass}?${query/url}" |
| 150 | + tal:content="query/name">query</a></td> |
| 151 | + <tal:block tal:condition="python: not query.creator == uid"> |
| 152 | + <td metal:use-macro="template/macros/include"> </td> |
| 153 | + </tal:block> |
| 154 | + <td colspan="2" i18n:translate="">[query is private]</td> |
| 155 | + <td tal:condition="python:query.creator == uid"> |
| 156 | + <input type="button" value="Restore" i18n:attributes="value" |
| 157 | + tal:attributes="onClick python:'''restore('%s','%s')'''%(query.id,anti_csrf_this_page)"> |
| 158 | + </td> |
| 159 | + <td colspan="1" tal:content="query/creator" i18n:translate="">put query owner here</td> |
| 160 | + </tal:block> |
| 161 | +</tr> |
| 162 | +</tal:block> |
98 | 163 | <tr><td colspan="5"> |
99 | 164 | <input type="hidden" name="@action" value="edit"> |
100 | 165 | <input type="hidden" name="@template" value="edit"> |
| 166 | + <input name="@csrf" type="hidden" |
| 167 | + tal:attributes="value anti_csrf_this_page"> |
101 | 168 | <input type="submit" value="Save Selection" i18n:attributes="value"> |
102 | 169 | </td></tr> |
103 | 170 |
|
|
0 commit comments