ihatemoney/ihatemoney/templates/settle_bills.html
Baptiste Jonglez 278a976501 Change settle endpoint to use POST instead of GET
This is necessary to avoid XSS.  State-changing actions should never be
done with a GET.
2024-03-31 19:55:43 +02:00

36 lines
1.4 KiB
HTML

{% extends "sidebar_table_layout.html" %}
{% block sidebar %}
<div id="table_overflow">
{{ balance_table(show_weight=False) }}
</div>
{% endblock %}
{% block content %}
<table id="bill_table" class="split_bills table table-striped">
<thead><tr><th>{{ _("Who pays?") }}</th><th>{{ _("To whom?") }}</th><th>{{ _("How much?") }}</th><th>{{ _("Settled?") }}</th></tr></thead>
<tbody>
{% for transaction in transactions %}
<tr>
<td>{{ transaction.ower }}</td>
<td>{{ transaction.receiver }}</td>
<td>{{ transaction.amount|currency }}</td>
<td>
<span id="settle-bill" class="ml-auto pb-2">
<form class="" action="{{ url_for(".add_settlement_bill") }}" method="POST">
{{ settlement_form.csrf_token }}
{{ settlement_form.amount(value=transaction.amount) }}
{{ settlement_form.sender_id(value=transaction.ower.id) }}
{{ settlement_form.receiver_id(value=transaction.receiver.id) }}
<button class="btn btn-primary" type="submit" title="{{ _("Settle") }}">{{ _("Settle") }}</button>
</form>
</a>
</span>
</td>
</tr>
{% endfor %}
</tbody>
</table>
{% endblock %}