fix(account): use absolute {% url %} for form actions in templates

Relative form action URLs broke on sub-pages (/profile/scenes/).
Pass edit_action_url and delete_action_url as context variables
to resource_list_pan.html from all 6 callers.

Author: mwfarb

users/templates/users/includes/profile_scripts.html

@@ -55,7 +55,7 @@
     }
 }
 
-async function confirmInlineDelete(event, listType, itemName) {
+async function confirmInlineDelete(event, listType, itemName, actionUrl) {
     event.preventDefault();
     const { isConfirmed } = await Swal.fire({
         title: 'Confirm Deletion',
@@ -67,7 +67,31 @@
     });
 
     if (isConfirmed) {
-        event.target.closest('form').submit();
+        // Create a dynamic form outside any existing form to avoid nesting
+        const form = document.createElement('form');
+        form.method = 'POST';
+        form.action = actionUrl;
+        form.style.display = 'none';
+        // CSRF token
+        const csrfInput = document.createElement('input');
+        csrfInput.type = 'hidden';
+        csrfInput.name = 'csrfmiddlewaretoken';
+        csrfInput.value = document.querySelector('[name=csrfmiddlewaretoken]').value;
+        form.appendChild(csrfInput);
+        // Selected item
+        const itemInput = document.createElement('input');
+        itemInput.type = 'hidden';
+        itemInput.name = 'selected_items';
+        itemInput.value = itemName;
+        form.appendChild(itemInput);
+        // Action
+        const actionInput = document.createElement('input');
+        actionInput.type = 'hidden';
+        actionInput.name = 'action';
+        actionInput.value = 'bulk_delete';
+        form.appendChild(actionInput);
+        document.body.appendChild(form);
+        form.submit();
     }
 }
 </script>

users/templates/users/includes/resource_list_pan.html

@@ -68,13 +68,7 @@
 
                 <!-- Name Column -->
                 <td>
-                    {% if list_type == 'scene' %}
-                        <a href="profile/scenes/{{ item.name }}" class="text-decoration-none text-dark"><b>{{ item.name }}</b></a>
-                    {% elif list_type == 'device' %}
-                        <a href="profile/devices/{{ item.name }}" class="text-decoration-none text-dark"><b>{{ item.name }}</b></a>
-                    {% else %}
-                        <a href="profile/namespaces/{{ item.name }}" class="text-decoration-none text-dark"><b>{{ item.name }}</b></a>
-                    {% endif %}
+                    <a href="{{ detail_base_url }}{{ item.name }}" class="text-decoration-none text-dark"><b>{{ item.name }}</b></a>
                 </td>
 
                 <!-- Updated Column -->
@@ -167,11 +161,15 @@
                 <!-- Actions -->
                 <td class="text-end">
                     <div class="btn-group btn-group-sm">
-                        <button type="submit" form="form-edit-{{ list_type }}-{{ forloop.counter }}" class="btn btn-outline-secondary" name="edit" value="{{ item.name }}" title="Edit"><i class="fas fa-cog"></i></button>
+                        <a href="{{ detail_base_url }}{{ item.name }}" class="btn btn-outline-secondary" title="Edit">
+                            <i class="fas fa-cog"></i>
+                        </a>
                         {% if list_type == 'scene' %}
                         <a href="{{ request.scheme }}://{{ request.META.HTTP_HOST }}/{{ item.name }}" class="btn btn-outline-primary" target="_blank" title="Open 3D View"><i class="fas fa-external-link-alt"></i></a>
                         {% endif %}
-                        <button type="submit" form="form-delete-{{ list_type }}-{{ forloop.counter }}" class="btn btn-outline-danger" name="action" value="delete_single" title="Delete" onclick="return confirmInlineDelete(event, '{{ list_type }}', '{{ item.name }}')"><i class="fas fa-trash-alt"></i></button>
+                        <button type="button" class="btn btn-outline-danger" title="Delete" onclick="confirmInlineDelete(event, '{{ list_type }}', '{{ item.name }}', '{{ delete_action_url }}')">
+                            <i class="fas fa-trash-alt"></i>
+                        </button>
                     </div>
                 </td>
             </tr>
@@ -196,19 +194,6 @@
     </div>
 </div>
 
-<!-- Hidden Forms for individual edit/delete actions -->
-{% for item in items %}
-<form id="form-edit-{{ list_type }}-{{ forloop.counter }}" action="profile_update_{{ list_type }}" method="POST" style="display:none;">
-    {% csrf_token %}
-    <input type="hidden" name="edit" value="{{ item.name }}">
-</form>
-<form id="form-delete-{{ list_type }}-{{ forloop.counter }}" action="profile_bulk_{{ list_type }}" method="POST" style="display:none;">
-    {% csrf_token %}
-    <input type="hidden" name="selected_items" value="{{ item.name }}">
-    <input type="hidden" name="action" value="bulk_delete">
-</form>
-{% endfor %}
-
 {% else %}
 <table class="table table-sm table-hover">
     <tr>

users/templates/users/profile_devices.html

@@ -29,7 +29,8 @@ <h1>All Device Permissions</h1>
 
             <form id="bulk-form-device" action="{% url 'users:profile_bulk_device' %}" method="POST">
                 {% csrf_token %}
-                {% include 'users/includes/resource_list_pan.html' with items=page_obj list_type='device' user=user allow_sort=True %}
+                {% url 'users:profile_bulk_device' as delete_action_url %}
+                {% include 'users/includes/resource_list_pan.html' with items=page_obj list_type='device' user=user allow_sort=True delete_action_url=delete_action_url detail_base_url='' %}
             </form>
 
             <!-- Pagination -->

users/templates/users/profile_namespaces.html

@@ -28,7 +28,8 @@ <h1>All Namespace Permissions</h1>
 
             <form id="bulk-form-namespace" action="{% url 'users:profile_bulk_namespace' %}" method="POST">
                 {% csrf_token %}
-                {% include 'users/includes/resource_list_pan.html' with items=page_obj list_type='namespace' user=user allow_sort=True %}
+                {% url 'users:profile_bulk_namespace' as delete_action_url %}
+                {% include 'users/includes/resource_list_pan.html' with items=page_obj list_type='namespace' user=user allow_sort=True delete_action_url=delete_action_url detail_base_url='' %}
             </form>
 
             <!-- Pagination -->

users/templates/users/profile_scenes.html

@@ -28,7 +28,8 @@ <h1>All Scene Permissions</h1>
 
             <form id="bulk-form-scene" action="{% url 'users:profile_bulk_scene' %}" method="POST">
                 {% csrf_token %}
-                {% include 'users/includes/resource_list_pan.html' with items=page_obj list_type='scene' user=user allow_sort=True %}
+                {% url 'users:profile_bulk_scene' as delete_action_url %}
+                {% include 'users/includes/resource_list_pan.html' with items=page_obj list_type='scene' user=user allow_sort=True delete_action_url=delete_action_url detail_base_url='' %}
             </form>
 
             <!-- Pagination -->

users/templates/users/user_profile.html

@@ -154,7 +154,7 @@ <h5>Last Updated Namespaces</h5>
                     class="btn btn-sm btn-outline-info" data-bs-toggle="button" aria-pressed="false" autocomplete="off"
                     {% if not user.is_staff %} disabled {% endif %}><i class="fas fa-plus"></i> Add</button>
             </div>
-            <form action="profile_update_namespace" method="POST">
+            <form action="{% url 'users:profile_update_namespace' %}" method="POST">
                 {% csrf_token %}
                 <div id="div_add_namespace" style="display: none;" class="input-group mb-3">
                     <input type="text" class="form-control" name="namespacename" placeholder="namespacename"
@@ -167,7 +167,8 @@ <h5>Last Updated Namespaces</h5>
             </form>
             <form id="bulk-form-namespace" action="{% url 'users:profile_bulk_namespace' %}" method="POST">
                 {% csrf_token %}
-                {% include 'users/includes/resource_list_pan.html' with items=namespaces list_type='namespace' user=user %}
+                {% url 'users:profile_bulk_namespace' as delete_action_url %}
+                {% include 'users/includes/resource_list_pan.html' with items=namespaces list_type='namespace' user=user delete_action_url=delete_action_url detail_base_url='profile/namespaces/' %}
             </form>
             {% if ns_count >= 1 %}
             <div class="text-right d-flex justify-content-end mb-4"><a href="{% url 'users:profile_namespaces' %}">View
@@ -183,7 +184,7 @@ <h5>Last Updated Scenes</h5>
                     class="btn btn-sm btn-outline-primary" data-bs-toggle="button" aria-pressed="false"
                     autocomplete="off"><i class="fas fa-plus"></i> Add</button>
             </div>
-            <form action="profile_update_scene" method="POST">
+            <form action="{% url 'users:profile_update_scene' %}" method="POST">
                 {% csrf_token %}
                 <div id="div_add_scene" style="display: none;" class="input-group mb-3">
                     <div class="input-group-prepend">
@@ -199,7 +200,8 @@ <h5>Last Updated Scenes</h5>
             </form>
             <form id="bulk-form-scene" action="{% url 'users:profile_bulk_scene' %}" method="POST">
                 {% csrf_token %}
-                {% include 'users/includes/resource_list_pan.html' with items=scenes list_type='scene' user=user %}
+                {% url 'users:profile_bulk_scene' as delete_action_url %}
+                {% include 'users/includes/resource_list_pan.html' with items=scenes list_type='scene' user=user delete_action_url=delete_action_url detail_base_url='profile/scenes/' %}
             </form>
             {% if sc_count >= 1 %}
             <div class="text-right d-flex justify-content-end mb-4"><a href="{% url 'users:profile_scenes' %}">View all
@@ -215,7 +217,7 @@ <h5>Last Updated Devices</h5>
                     class="btn btn-sm btn-outline-success" data-bs-toggle="button" aria-pressed="false"
                     autocomplete="off"><i class="fas fa-plus"></i> Add</button>
             </div>
-            <form action="profile_update_device" method="POST">
+            <form action="{% url 'users:profile_update_device' %}" method="POST">
                 {% csrf_token %}
                 <div id="div_add_device" style="display: none;" class="input-group mb-3">
                     <div class="input-group-prepend">
@@ -231,7 +233,8 @@ <h5>Last Updated Devices</h5>
             </form>
             <form id="bulk-form-device" action="{% url 'users:profile_bulk_device' %}" method="POST">
                 {% csrf_token %}
-                {% include 'users/includes/resource_list_pan.html' with items=devices list_type='device' user=user %}
+                {% url 'users:profile_bulk_device' as delete_action_url %}
+                {% include 'users/includes/resource_list_pan.html' with items=devices list_type='device' user=user delete_action_url=delete_action_url detail_base_url='profile/devices/' %}
             </form>
             {% if dev_count >= 1 %}
             <div class="text-right d-flex justify-content-end mb-4"><a href="{% url 'users:profile_devices' %}">View all