From 2fb85e138e5fbe7e8a40fb86eaf867dd2d4a91b9 Mon Sep 17 00:00:00 2001
From: Thomas Sileo <t@a4.io>
Date: Mon, 29 Aug 2022 20:11:31 +0200
Subject: [PATCH] Remove inlined JS

---
 app/config.py                | 12 ++++++++++++
 app/static/common-admin.js   |  9 +++++++++
 app/templates.py             |  1 +
 app/templates/admin_new.html |  2 +-
 app/templates/layout.html    |  3 +++
 app/templates/utils.html     |  2 +-
 6 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 app/static/common-admin.js

diff --git a/app/config.py b/app/config.py
index d497cad..f08c1de 100644
--- a/app/config.py
+++ b/app/config.py
@@ -36,6 +36,18 @@ try:
 except FileNotFoundError:
     pass
 
+# Force reloading cache when the JS is changed
+JS_HASH = "none"
+try:
+    # To keep things simple, we keep a single hash for the 2 files
+    js_data_common = (ROOT_DIR / "app" / "static" / "common-admin.js").read_bytes()
+    js_data_new = (ROOT_DIR / "app" / "static" / "new.js").read_bytes()
+    JS_HASH = hashlib.md5(
+        js_data_common + js_data_new, usedforsecurity=False
+    ).hexdigest()
+except FileNotFoundError:
+    pass
+
 
 VERSION = f"2.0.0+{VERSION_COMMIT}"
 USER_AGENT = f"microblogpub/{VERSION}"
diff --git a/app/static/common-admin.js b/app/static/common-admin.js
new file mode 100644
index 0000000..f8d5c63
--- /dev/null
+++ b/app/static/common-admin.js
@@ -0,0 +1,9 @@
+document.addEventListener('DOMContentLoaded', (ev) => {
+  // Add confirm to "delete" button next to outbox objects
+  var forms = document.getElementsByClassName("object-delete-form")
+  for (var i = 0; i < forms.length; i++) {
+    forms[i].addEventListener('submit', (ev) => {
+      return confirm('Do you really want to delete this object?');
+    });
+  }
+});
diff --git a/app/templates.py b/app/templates.py
index ab229be..0b3b493 100644
--- a/app/templates.py
+++ b/app/templates.py
@@ -418,3 +418,4 @@ _templates.env.filters["pluralize"] = _pluralize
 _templates.env.filters["parse_datetime"] = _parse_datetime
 _templates.env.filters["poll_item_pct"] = _poll_item_pct
 _templates.env.filters["privacy_replace_url"] = privacy_replace.replace_url
+_templates.env.globals["JS_HASH"] = config.JS_HASH
diff --git a/app/templates/admin_new.html b/app/templates/admin_new.html
index 8b43b6a..f86425a 100644
--- a/app/templates/admin_new.html
+++ b/app/templates/admin_new.html
@@ -90,5 +90,5 @@
     </p>
 </form>
 </div>
-<script src="/static/new.js"></script>
+<script src="/static/new.js?v={{ JS_HASH }}"></script>
 {% endblock %}
diff --git a/app/templates/layout.html b/app/templates/layout.html
index 8e7a0c3..380e588 100644
--- a/app/templates/layout.html
+++ b/app/templates/layout.html
@@ -54,5 +54,8 @@
     {% endif %}
     </div>
 </footer>
+{% if is_admin %}
+<script src="/static/common-admin.js?v={{ JS_HASH }}"></script>
+{% endif %}
 </body>
 </html>
diff --git a/app/templates/utils.html b/app/templates/utils.html
index 560e075..085aa22 100644
--- a/app/templates/utils.html
+++ b/app/templates/utils.html
@@ -97,7 +97,7 @@
 {% endmacro %}
 
 {% macro admin_delete_button(ap_object_id) %}
-<form action="{{ request.url_for("admin_actions_delete") }}" method="POST" onsubmit="return confirm('Do you really want to delete this object?');">
+<form action="{{ request.url_for("admin_actions_delete") }}" class="object-delete-form" method="POST">
     {{ embed_csrf_token() }}
     {{ embed_redirect_url() }}
     <input type="hidden" name="ap_object_id" value="{{ ap_object_id }}">