Usage of WTForms for report action

nyaa/forms.py

@@ -6,7 +6,7 @@ import os
 import re
 from flask_wtf import FlaskForm
 from flask_wtf.file import FileField, FileRequired
-from wtforms import StringField, PasswordField, BooleanField, TextAreaField, SelectField
+from wtforms import StringField, PasswordField, BooleanField, TextAreaField, SelectField, HiddenField
 from wtforms.validators import DataRequired, Optional, Email, Length, EqualTo, ValidationError
 from wtforms.validators import Regexp
 
@@ -287,6 +287,12 @@ class ReportForm(FlaskForm):
     ])
 
 
+class ReportActionForm(FlaskForm):
+    action = SelectField(choices=[('close', 'Close'), ('hide', 'Hide'), ('delete', 'Delete')])
+    torrent = HiddenField()
+    report = HiddenField()
+
+
 def _validate_trackers(torrent_dict, tracker_to_check_for=None):
     announce = torrent_dict.get('announce')
     announce_string = _validate_bytes(announce, 'announce', 'utf-8')

nyaa/routes.py

@@ -693,30 +693,35 @@ def view_reports():
 
     page = flask.request.args.get('p', flask.request.args.get('offset', 1, int), int)
     reports = models.Report.not_reviewed(page)
+    report_action = forms.ReportActionForm(flask.request.form)
 
-    if flask.request.method == 'POST':
-        data = flask.request.form
-        torrent = models.Torrent.by_id(data['torrent'])
-        report = models.Report.by_id(data['report'])
+    if flask.request.method == 'POST' and report_action.validate():
+        action = report_action.action.data
+        torrent_id = report_action.torrent.data
+        report_id = report_action.report.data
+        torrent = models.Torrent.by_id(torrent_id)
+        report = models.Report.by_id(report_id)
+        
         if not torrent or not report or report.status != 0:
             flask.abort(404)
         else:
-            if data['action'] == 'delete':
+            if action == 'delete':
                 torrent.deleted = True
                 report.status = 1
-            elif data['action'] == 'hide':
+            elif action == 'hide':
                 torrent.hidden = True
                 report.status = 1
             else:
                 report.status = 2
 
-            models.Report.remove_reviewed(data['torrent'])
+            models.Report.remove_reviewed(torrent_id)
             db.session.commit()
             flask.flash('Closed report #{}'.format(report.id), 'success')
             return flask.redirect(flask.url_for('view_reports'))
 
     return flask.render_template('reports.html',
-                                 reports=reports)
+                                 reports=reports,
+                                 report_action=report_action)
 
 
 def _get_cached_torrent_file(torrent):

nyaa/templates/reports.html

@@ -28,13 +28,10 @@
 				<td>{{ report.created_time }}</td>
 				<td style="width: 15%">
 					<form method="post">
-						<select name="action" class="pull-left">
-							<option value="close">Close</option>
-							<option value="delete">Delete</option>
-							<option value="hide">Hide</option>
-						</select>
-						<input type="hidden" value="{{ report.torrent.id }}" name="torrent">
-						<input type="hidden" value="{{ report.id }}" name="report">
+						{{ report_action.csrf_token }}
+						{{ report_action.action }}
+						{{ report_action.torrent(value=report.torrent.id) }}
+						{{ report_action.report(value=report.id) }}
 						<button type="submit" class="btn btn-primary pull-right">Review</button>
 					</form>
 				</td>