From 03f1e56161a8de68d14df48afccfa8bf8ab0d9c6 Mon Sep 17 00:00:00 2001
From: Midgard <midgard@zeus.ugent.be>
Date: Mon, 2 May 2022 22:25:06 +0200
Subject: [PATCH] Fix bug with form inside form

---
 app/templates/order.html | 8 +++-----
 app/views/order.py       | 7 +++++--
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/app/templates/order.html b/app/templates/order.html
index a9a6dcd..39d43c7 100644
--- a/app/templates/order.html
+++ b/app/templates/order.html
@@ -267,7 +267,7 @@
 <section class="single_column">
 	<div class="box" id="per_person">
 		<h3>Items per person</h3>
-		<form action="{{ url_for('order_bp.items_user_paid', order_id=order.id) }}" method="post">
+		<form action="{{ url_for('order_bp.modify_items', order_id=order.id) }}" method="post">
 		<table class="table table-condensed">
 			<thead>
 				<tr><th>Total</th><th>Name</th><th>Items</th></tr>
@@ -293,11 +293,9 @@
 							<li class="{{ 'paid' if item.paid }}">
 								<div class="actions">
 								{% if item.can_delete(order.id, current_user.id, session.get('anon_name', '')) -%}
-									<form action="{{ url_for('order_bp.delete_item', order_id=order.id, item_id=item.id) }}" method="post" style="display:inline">
-										<button class="btn btn-link btn-sm" type="submit" style="padding: 0 0.5em;"><span class="glyphicon glyphicon-remove"></span></button>
-									</form>
+									<button class="btn btn-link btn-sm" type="submit" name="delete_item" value="{{ item.id }}" style="padding: 0 0.5em;"><span class="glyphicon glyphicon-remove"></span></button>
 								{% else %}
-									<span class="glyphicon glyphicon-remove" style="color: var(--gray3); padding: 0 0.5em"></span>
+									<span class="glyphicon glyphicon-remove" style="color: var(--gray3); padding: 0 0.5em; cursor: not-allowed"></span>
 								{%- endif %}
 								</div>
 
diff --git a/app/views/order.py b/app/views/order.py
index 4d3415c..d05944a 100644
--- a/app/views/order.py
+++ b/app/views/order.py
@@ -226,10 +226,12 @@ def order_item_create(order_id: int) -> typing.Any:
     return redirect(url_for("order_bp.order_from_id", order_id=order_id))
 
 
-@order_bp.route("/<order_id>/users_paid", methods=["POST"])
+@order_bp.route("/<order_id>/modify_items", methods=["POST"])
 @login_required
 # pylint: disable=R1710
-def items_user_paid(order_id: int) -> typing.Optional[Response]:
+def modify_items(order_id: int) -> typing.Optional[Response]:
+    if "delete_item" in request.form:
+        return delete_item(order_id, int(request.form["delete_item"]))
     user_names = request.form.getlist("user_names")
     if request.form.get("action") == "mark_paid":
         return set_items_paid(order_id, user_names, True)
@@ -237,6 +239,7 @@ def items_user_paid(order_id: int) -> typing.Optional[Response]:
         return set_items_paid(order_id, user_names, False)
     else:
         abort(404)
+        return None
 
 def set_items_paid(order_id: int, user_names: typing.Iterable[str], paid: bool):
     total_paid_items = 0