diff --git a/readthedocs/projects/views/private.py b/readthedocs/projects/views/private.py index 72a0df2cd94..23ed1910fe4 100644 --- a/readthedocs/projects/views/private.py +++ b/readthedocs/projects/views/private.py @@ -215,9 +215,9 @@ def form_valid(self, form): class ProjectVersionDeleteHTML(ProjectVersionMixin, GenericModelView): - http_method_names = ['get', 'post'] + http_method_names = ['post'] - def get(self, request, *args, **kwargs): + def post(self, request, *args, **kwargs): version = self.get_object() if not version.active: version.built = False @@ -233,9 +233,6 @@ def get(self, request, *args, **kwargs): ) return HttpResponseRedirect(self.get_success_url()) - def post(self, request, *args, **kwargs): - return self.get(request, *args, **kwargs) - class ImportWizardView( ProjectImportMixin, ProjectSpamMixin, PrivateViewMixin, @@ -640,17 +637,14 @@ def get_context_data(self, **kwargs): class ProjectTranslationsDelete(ProjectTranslationsMixin, GenericView): - http_method_names = ['get', 'post'] + http_method_names = ['post'] - def get(self, request, *args, **kwargs): + def post(self, request, *args, **kwargs): project = self.get_project() translation = self.get_translation(kwargs['child_slug']) project.translations.remove(translation) return HttpResponseRedirect(self.get_success_url()) - def post(self, request, *args, **kwargs): - return self.get(request, *args, **kwargs) - def get_translation(self, slug): project = self.get_project() translation = get_object_or_404( diff --git a/readthedocs/rtd_tests/tests/test_privacy_urls.py b/readthedocs/rtd_tests/tests/test_privacy_urls.py index 18b23bf7734..08412efe323 100644 --- a/readthedocs/rtd_tests/tests/test_privacy_urls.py +++ b/readthedocs/rtd_tests/tests/test_privacy_urls.py @@ -238,10 +238,6 @@ class PrivateProjectAdminAccessTest(PrivateProjectMixin, TestCase): '/dashboard/import/manual/demo/': {'status_code': 302}, '/dashboard/pip/': {'status_code': 301}, '/dashboard/pip/subprojects/delete/sub/': {'status_code': 302}, - '/dashboard/pip/translations/delete/sub/': {'status_code': 302}, - - # This depends on an inactive project - '/dashboard/pip/version/latest/delete_html/': {'status_code': 400}, # 405's where we should be POST'ing '/dashboard/pip/users/delete/': {'status_code': 405}, @@ -252,6 +248,8 @@ class PrivateProjectAdminAccessTest(PrivateProjectMixin, TestCase): '/dashboard/pip/integrations/{integration_id}/sync/': {'status_code': 405}, '/dashboard/pip/integrations/{integration_id}/delete/': {'status_code': 405}, '/dashboard/pip/environmentvariables/{environmentvariable_id}/delete/': {'status_code': 405}, + '/dashboard/pip/translations/delete/sub/': {'status_code': 405}, + '/dashboard/pip/version/latest/delete_html/': {'status_code': 405}, } def get_url_path_ctx(self): @@ -288,6 +286,8 @@ class PrivateProjectUserAccessTest(PrivateProjectMixin, TestCase): '/dashboard/pip/integrations/{integration_id}/sync/': {'status_code': 405}, '/dashboard/pip/integrations/{integration_id}/delete/': {'status_code': 405}, '/dashboard/pip/environmentvariables/{environmentvariable_id}/delete/': {'status_code': 405}, + '/dashboard/pip/translations/delete/sub/': {'status_code': 405}, + '/dashboard/pip/version/latest/delete_html/': {'status_code': 405}, } # Filtered out by queryset on projects that we don't own. diff --git a/readthedocs/templates/projects/project_translations.html b/readthedocs/templates/projects/project_translations.html index dbcd9348626..70b0b2c47a2 100644 --- a/readthedocs/templates/projects/project_translations.html +++ b/readthedocs/templates/projects/project_translations.html @@ -44,7 +44,12 @@

{% trans "Existing Translations" %}

{{ lang_project.name }} ({{ lang_project.get_language_display }}) {% empty %} diff --git a/readthedocs/templates/projects/project_version_detail.html b/readthedocs/templates/projects/project_version_detail.html index b10c23d1307..c9135dfaf0b 100644 --- a/readthedocs/templates/projects/project_version_detail.html +++ b/readthedocs/templates/projects/project_version_detail.html @@ -19,11 +19,14 @@

Editing {{ version.slug }}

{% if request.user|is_admin:project %} {% if not version.active and version.built %} +
+ {% csrf_token %} +

- {% url "project_version_delete_html" project.slug version.slug as version_delete_url %} + {# We are submitting the form using javascript because it breaks the UI design if we use buttons #} {% blocktrans trimmed %} This version is inactive but its documentation is still available online. - You can delete this version's documentation if you want to remove it completely. + You can delete this version's documentation if you want to remove it completely. {% endblocktrans %}

{% endif %}