From b0f2ca592bed213b669cb22f308125ebabbddba1 Mon Sep 17 00:00:00 2001
From: richard <richard@57a73879-2fb5-44c3-a270-3262357dd7e2>
Date: Thu, 26 Mar 2009 06:17:49 +0000
Subject: [PATCH] fixed classic tracker template to submit POST requests when
 appropriate

git-svn-id: http://svn.roundup-tracker.org/svnroot/roundup/roundup/trunk@4212 57a73879-2fb5-44c3-a270-3262357dd7e2
---
 CHANGES.txt                                   |  1 +
 doc/upgrading.txt                             | 52 ++++++++++++++++++-
 .../templates/classic/html/issue.item.html    |  4 +-
 3 files changed, 54 insertions(+), 3 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 7800cb4..508b334 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -6,6 +6,7 @@ are given with the most recent entry first.
 Fixes:
 
 - fixed action taken in response to invalid GET request
+- fixed classic tracker template to submit POST requests when appropriate
 
 
 2009-03-18 1.4.8 (r4209)
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 39f27f4..a224872 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -13,6 +13,56 @@ steps.
 
 .. contents::
 
+Migrating from 1.4.x to 1.4.9
+=============================
+
+Fix the "remove" button in issue files and messages lists
+---------------------------------------------------------
+
+The "remove" button(s) in the issue messages list needs to be altered. Find
+the following in your tracker's ``html/issue.item.html`` template::
+
+  <td>
+   <form style="padding:0" tal:condition="context/is_edit_ok"
+         tal:attributes="action string:issue${context/id}">
+    <input type="hidden" name="@remove@files" tal:attributes="value file/id">
+
+and add ``method="POST"`` as shown below::
+
+  <td>
+   <form style="padding:0" method="POST" tal:condition="context/is_edit_ok"
+         tal:attributes="action string:issue${context/id}">
+    <input type="hidden" name="@remove@files" tal:attributes="value file/id">
+
+Then also find::
+
+  <td>
+   <form style="padding:0" tal:condition="context/is_edit_ok"
+         tal:attributes="action string:issue${context/id}">
+    <input type="hidden" name="@remove@messages" tal:attributes="value msg/id">
+
+and add ``method="POST"`` as shown below::
+
+  <td>
+   <form style="padding:0" method="POST" tal:condition="context/is_edit_ok"
+         tal:attributes="action string:issue${context/id}">
+    <input type="hidden" name="@remove@messages" tal:attributes="value msg/id">
+
+
+Fixing the "retire" button in user management list
+--------------------------------------------------
+
+If you made the change to the "reture" link in the user management list as
+listed below in `Migrating from 1.4.x to 1.4.7`_ then you'll need to fix that
+change by adding ``method="POST"`` to the ``<form>`` tag::
+
+     <form style="padding:0" method="POST"
+           tal:attributes="action string:user${user/id}">
+      <input type="hidden" name="@template" value="index">
+      <input type="hidden" name="@action" value="retire">
+      <input type="submit" value="retire" i18n:attributes="value">
+     </form>
+
 
 Migrating from 1.4.x to 1.4.7
 =============================
@@ -53,7 +103,7 @@ The "retire" link found in the file ``html/users.index.html``::
 Should be replaced with::
 
   <td tal:condition="context/is_retire_ok">
-     <form style="padding:0"
+     <form style="padding:0" method="POST"
            tal:attributes="action string:user${user/id}">
       <input type="hidden" name="@template" value="index">
       <input type="hidden" name="@action" value="retire">
diff --git a/share/roundup/templates/classic/html/issue.item.html b/share/roundup/templates/classic/html/issue.item.html
index 41ee073..f84114f 100644
--- a/share/roundup/templates/classic/html/issue.item.html
+++ b/share/roundup/templates/classic/html/issue.item.html
@@ -151,7 +151,7 @@ python:db.user.classhelp('username,realname,address', property='nosy', width='60
           tal:attributes="href string:file${file/id}">edit</a>
   </td>
   <td>
-   <form style="padding:0" tal:condition="context/is_edit_ok"
+   <form style="padding:0" method="POST" tal:condition="context/is_edit_ok"
          tal:attributes="action string:issue${context/id}">
     <input type="hidden" name="@remove@files" tal:attributes="value file/id">
     <input type="hidden" name="@action" value="edit">
@@ -172,7 +172,7 @@ python:db.user.classhelp('username,realname,address', property='nosy', width='60
    <th i18n:translate="">Date: <tal:x replace="msg/date"
        i18n:name="date" /></th>
    <th>
-    <form style="padding:0" tal:condition="context/is_edit_ok"
+    <form style="padding:0" method="POST" tal:condition="context/is_edit_ok"
           tal:attributes="action string:issue${context/id}">
      <input type="hidden" name="@remove@messages" tal:attributes="value msg/id">
      <input type="hidden" name="@action" value="edit">
-- 
2.30.2