From ec0f8000d72635a128db10bdc391513524930903 Mon Sep 17 00:00:00 2001
From: nyaazi <nyaazi@users.noreply.github.com>
Date: Sat, 20 May 2017 14:23:29 +0300
Subject: [PATCH] Usage of WTForms for report action

---
 nyaa/forms.py               |  8 +++++++-
 nyaa/routes.py              | 21 +++++++++++++--------
 nyaa/templates/reports.html | 11 ++++-------
 3 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/nyaa/forms.py b/nyaa/forms.py
index 32e772b..603f4c3 100644
--- a/nyaa/forms.py
+++ b/nyaa/forms.py
@@ -6,7 +6,7 @@ import os
 import re
 from flask_wtf import FlaskForm
 from flask_wtf.file import FileField, FileRequired
-from wtforms import StringField, PasswordField, BooleanField, TextAreaField, SelectField
+from wtforms import StringField, PasswordField, BooleanField, TextAreaField, SelectField, HiddenField
 from wtforms.validators import DataRequired, Optional, Email, Length, EqualTo, ValidationError
 from wtforms.validators import Regexp
 
@@ -287,6 +287,12 @@ class ReportForm(FlaskForm):
     ])
 
 
+class ReportActionForm(FlaskForm):
+    action = SelectField(choices=[('close', 'Close'), ('hide', 'Hide'), ('delete', 'Delete')])
+    torrent = HiddenField()
+    report = HiddenField()
+
+
 def _validate_trackers(torrent_dict, tracker_to_check_for=None):
     announce = torrent_dict.get('announce')
     announce_string = _validate_bytes(announce, 'announce', 'utf-8')
diff --git a/nyaa/routes.py b/nyaa/routes.py
index d12c002..6e37cb5 100644
--- a/nyaa/routes.py
+++ b/nyaa/routes.py
@@ -693,30 +693,35 @@ def view_reports():
 
     page = flask.request.args.get('p', flask.request.args.get('offset', 1, int), int)
     reports = models.Report.not_reviewed(page)
+    report_action = forms.ReportActionForm(flask.request.form)
 
-    if flask.request.method == 'POST':
-        data = flask.request.form
-        torrent = models.Torrent.by_id(data['torrent'])
-        report = models.Report.by_id(data['report'])
+    if flask.request.method == 'POST' and report_action.validate():
+        action = report_action.action.data
+        torrent_id = report_action.torrent.data
+        report_id = report_action.report.data
+        torrent = models.Torrent.by_id(torrent_id)
+        report = models.Report.by_id(report_id)
+        
         if not torrent or not report or report.status != 0:
             flask.abort(404)
         else:
-            if data['action'] == 'delete':
+            if action == 'delete':
                 torrent.deleted = True
                 report.status = 1
-            elif data['action'] == 'hide':
+            elif action == 'hide':
                 torrent.hidden = True
                 report.status = 1
             else:
                 report.status = 2
 
-            models.Report.remove_reviewed(data['torrent'])
+            models.Report.remove_reviewed(torrent_id)
             db.session.commit()
             flask.flash('Closed report #{}'.format(report.id), 'success')
             return flask.redirect(flask.url_for('view_reports'))
 
     return flask.render_template('reports.html',
-                                 reports=reports)
+                                 reports=reports,
+                                 report_action=report_action)
 
 
 def _get_cached_torrent_file(torrent):
diff --git a/nyaa/templates/reports.html b/nyaa/templates/reports.html
index 6b85840..455a6e9 100644
--- a/nyaa/templates/reports.html
+++ b/nyaa/templates/reports.html
@@ -28,13 +28,10 @@
 				<td>{{ report.created_time }}</td>
 				<td style="width: 15%">
 					<form method="post">
-						<select name="action" class="pull-left">
-							<option value="close">Close</option>
-							<option value="delete">Delete</option>
-							<option value="hide">Hide</option>
-						</select>
-						<input type="hidden" value="{{ report.torrent.id }}" name="torrent">
-						<input type="hidden" value="{{ report.id }}" name="report">
+						{{ report_action.csrf_token }}
+						{{ report_action.action }}
+						{{ report_action.torrent(value=report.torrent.id) }}
+						{{ report_action.report(value=report.id) }}
 						<button type="submit" class="btn btn-primary pull-right">Review</button>
 					</form>
 				</td>