Replace submit to hyperlink for comment operations

OWASP-BLT · Jun 9, 2017 · 6086f60 · 6086f60
1 parent 89ce21d
commit 6086f60
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 12 deletions.
diff --git a/bugheist/urls.py b/bugheist/urls.py
@@ -50,7 +50,7 @@
     url(r'^favicon\.ico$', favicon_view),
     url(r'^sendgrid_webhook/$', csrf_exempt(InboundParseWebhookView.as_view()), name='inbound_event_webhook_callback'),
     url(r'^issue/comment/(?P<pk>\d+)/$',comments.views.AddComment, name='add_comment'),
-    url(r'^issue/comment/(?P<pk>\d+)/edit/$',comments.views.EditCommentPage, name='edit_commentpage'),
+    url(r'^issue/comment/(?P<pk>\d+)/edit/$',comments.views.EditCommentPage, name='edit_comment'),
     url(r'^issue/comment/(?P<pk>\d+)/update/$',comments.views.EditComment, name='update_comment'),
     url(r'^issue/comment/(?P<pk>\d+)/delete/$',comments.views.DeleteComment, name='delete_comment'),
 

diff --git a/comments/views.py b/comments/views.py
@@ -41,5 +41,4 @@ def EditCommentPage(request,pk):
     comment = get_object_or_404(Comment,pk=pk)
     if request.user.username!=comment.author:
         return HttpResponse("Can't Edit this comment")
-    if request.method=="POST":
-        return render(request,'edit_comment.html',{'comment':comment})
+    return render(request,'edit_comment.html',{'comment':comment})
diff --git a/website/templates/issue.html b/website/templates/issue.html
@@ -188,15 +188,9 @@ <h3>Comments:</h3>
     <div class="comment">
         <div style="display: inline-flex;">
             <div class="date">{{ comment.created_date }}</div>
-            {% if user.username == comment.author  %}
-                <form class="form-inline" method="post" action="{% url 'comments.views.EditCommentPage' pk=comment.pk %}">
-                    {% csrf_token %}
-                    <button class="btn btn-xs btn-primary" type="submit">Edit</button>
-                </form>
-                <form class="form-inline" id="delete_form" method="post" action="{% url 'comments.views.DeleteComment' pk=comment.pk %}">
-                    {% csrf_token %}
-                    <button class="btn btn-xs btn-danger" type="submit">Delete</button>
-                </form>
+            {% if user.username == comment.author  %}                
+                <a class="btn btn-xs btn-primary" href="{% url 'comments.views.EditCommentPage' pk=comment.pk %}">Edit</a>                    
+                <a class="btn btn-xs btn-danger" href="{% url 'comments.views.DeleteComment' pk=comment.pk %}">Delete</a>
             {% endif %}
         </div>
         <div>