From 063313f87bfda6f528d428dd95cf6d07e401e619 Mon Sep 17 00:00:00 2001
From: Luca <Luca@hackerspace-bamberg.de>
Date: Tue, 14 May 2024 23:57:59 +0200
Subject: [PATCH] chore: add csrf protection for changes to registration state

---
 .../team/templates/checkin_list.html          | 10 ++++-
 .../team/templates/csrf_protect.html          | 12 ++++++
 shiftregister/team/templates/molly_guard.html | 12 ------
 .../team/templates/shift_detail.html          | 15 +++++--
 shiftregister/team/views.py                   | 39 +++++++++++++++----
 5 files changed, 64 insertions(+), 24 deletions(-)
 create mode 100644 shiftregister/team/templates/csrf_protect.html
 delete mode 100644 shiftregister/team/templates/molly_guard.html

diff --git a/shiftregister/team/templates/checkin_list.html b/shiftregister/team/templates/checkin_list.html
index 9c0723f..067a4e0 100644
--- a/shiftregister/team/templates/checkin_list.html
+++ b/shiftregister/team/templates/checkin_list.html
@@ -33,8 +33,14 @@
             <td><a href="{% url 'team:shift' reg.shift.pk %}">{{ reg.shift.duration|duration }}</a></td>
             <td>
                 <div class="buttons">
-                    <a class="button is-success is-small" href="{% url 'team:checkin' reg.pk %}">Als angekommen markieren</a>
-                    <a class="button is-danger is-small" href="{% url 'team:mark_as_failed' reg.pk %}">Nicht angetreten</a>
+                    <form action="{% url 'team:checkin' reg.pk %}" method="post">
+                        {% csrf_token %}
+                        <button class="button is-success is-small mr-2" type="submit">Als angekommen markieren</button>
+                    </form>
+                    <form action="{% url 'team:mark_as_failed' reg.pk %}" method="post">
+                        {% csrf_token %}
+                        <button class="button is-danger is-small mr-2" type="submit">Nicht angetreten</button>
+                    </form>
                     <a class="button is-link is-small" href="tel:{{ reg.helper.phone }}">📞</a>
                 </div>
             </td>
diff --git a/shiftregister/team/templates/csrf_protect.html b/shiftregister/team/templates/csrf_protect.html
new file mode 100644
index 0000000..98bbead
--- /dev/null
+++ b/shiftregister/team/templates/csrf_protect.html
@@ -0,0 +1,12 @@
+{% extends "base.html" %}
+
+{% block title %}{{ action|default:"Aktion bestätigen" }}{% endblock %}
+
+{% block content %}
+<h3 class="title">{{ action|default:"Aktion bestätigen" }}</h3>
+<form method="POST">
+    {% csrf_token %}
+    <button class="button is-{{ button_style|default:"danger" }} is-small" type="submit">{{ button_text|default:"Bestätigen" }}</button>
+</form>
+<a class="button mt-3" href="{% url 'team:shift' reg.shift.pk %}">Zurück</a>
+{% endblock %}
diff --git a/shiftregister/team/templates/molly_guard.html b/shiftregister/team/templates/molly_guard.html
deleted file mode 100644
index b531af1..0000000
--- a/shiftregister/team/templates/molly_guard.html
+++ /dev/null
@@ -1,12 +0,0 @@
-{% extends "base.html" %}
-
-{% block title %}Helfer*in wirklich sperren?{% endblock %}
-
-{% block content %}
-<h3 class="title">Helfer*in wirklich sperren?</h3>
-<form method="POST">
-    {% csrf_token %}
-    <button class="button is-danger is-small" type="submit">Schicht als "nicht angetreten" markieren und Helfer*in sperren</button>
-</form>
-<a class="button mt-3" href="{% url 'team:shift' reg.shift.pk %}">Zurück</a>
-{% endblock %}
diff --git a/shiftregister/team/templates/shift_detail.html b/shiftregister/team/templates/shift_detail.html
index ba8f5fe..02f37f7 100644
--- a/shiftregister/team/templates/shift_detail.html
+++ b/shiftregister/team/templates/shift_detail.html
@@ -32,9 +32,18 @@
             </div>
             <div class="buttons">
 {% if reg.is_pending %}
-                <a class="button is-success is-small" href="{% url 'team:checkin' reg.pk %}">Als angekommen markieren</a>
-                <a class="button is-warning is-small" href="{% url 'team:unregister' reg.pk %}">Helfer*in abmelden</a>
-                <a class="button is-danger is-small" href="{% url 'team:mark_as_failed' reg.pk %}">Nicht angetreten</a>
+                <form action="{% url 'team:checkin' reg.pk %}" method="post">
+                    {% csrf_token %}
+                    <button class="button is-success is-small mr-2" type="submit">Als angekommen markieren</button>
+                </form>
+                <form action="{% url 'team:unregister' reg.pk %}" method="post">
+                    {% csrf_token %}
+                    <button class="button is-warning is-small mr-2" type="submit">Helfer*in abmelden</button>
+                </form>
+                <form action="{% url 'team:mark_as_failed' reg.pk %}" method="post">
+                    {% csrf_token %}
+                    <button class="button is-danger is-small" type="submit">Nicht angetreten</button>
+                </form>
 {% elif reg.is_checked_in %}
                 <button class="button is-success is-small" style="pointer-events:none;">✓</button>
 {% endif %}
diff --git a/shiftregister/team/views.py b/shiftregister/team/views.py
index 0fdff7c..8ba11ed 100644
--- a/shiftregister/team/views.py
+++ b/shiftregister/team/views.py
@@ -308,9 +308,18 @@ class CheckinList(LoginRequiredMixin, ListView):
 @login_required
 def checkin(request, pk):
     reg = get_object_or_404(ShiftRegistration, pk=pk)
-    reg.state = reg.RegState.CHECKED_IN
-    reg.save()
-    return redirect("team:shift", pk=reg.shift.pk)
+
+    if request.method == "POST":
+        reg.state = reg.RegState.CHECKED_IN
+        reg.save()
+
+        return redirect("team:shift", pk=reg.shift.pk)
+
+    return render(
+        request,
+        "csrf_protect.html",
+        {"action": "Als angekommen markieren", "button_text": "Angekommen", "reg": reg},
+    )
 
 
 @login_required
@@ -326,15 +335,31 @@ def mark_as_failed(request, pk):
 
         return redirect("team:shift", pk=reg.shift.pk)
 
-    return render(request, "molly_guard.html", {"reg": reg})
+    return render(
+        request,
+        "csrf_protect.html",
+        {
+            "action": 'Schicht als "nicht angetreten" markieren',
+            "button_text": "Nicht angetreten",
+            "reg": reg,
+        },
+    )
 
 
 @login_required
 def delete_shiftregistration(request, pk):
     reg = get_object_or_404(ShiftRegistration, pk=pk)
-    spk = reg.shift.pk
-    reg.delete()
-    return redirect("team:shift", pk=spk)
+
+    if request.method == "POST":
+        reg.delete()
+
+        return redirect("team:shift", pk=reg.shift.pk)
+
+    return render(
+        request,
+        "csrf_protect.html",
+        {"action": "Helfer*in abmelden", "button_text": "Abmelden", "reg": reg},
+    )
 
 
 class IncomingMessagesList(LoginRequiredMixin, ListView):