(tooling-trusted-releases) 01/01: Fix form confirms that were broken by CSP

[ar...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

alitheg pushed a commit to branch arm
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git

commit d4e558c4860ec21c5296edb859ddd046e69b4c1d
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Wed Apr 22 14:31:17 2026 +0100

    Fix form confirms that were broken by CSP
---
 atr/form.py                     | 3 +--
 atr/templates/layouts/base.html | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/atr/form.py b/atr/form.py
index c9af126c..8de2a112 100644
--- a/atr/form.py
+++ b/atr/form.py
@@ -357,10 +357,9 @@ async def render(  # noqa: C901
         "enctype": "multipart/form-data",
     }
     if confirm:
-        # audit_guidance building JavaScript with string concatenation is an intentional choice for simplicity
         if not _CONFIRM_PATTERN.match(confirm):
             raise ValueError(f"Invalid characters in confirm message: {confirm!r}")
-        form_attrs["onsubmit"] = f"return confirm('{confirm}');"
+        form_attrs["data-confirm"] = confirm
 
     return htm.form(form_classes, **form_attrs)[form_children]
 
diff --git a/atr/templates/layouts/base.html b/atr/templates/layouts/base.html
index d30cc8c1..f18efe37 100644
--- a/atr/templates/layouts/base.html
+++ b/atr/templates/layouts/base.html
@@ -72,6 +72,7 @@
 
     {% block javascripts %}
       <script src="{{ static_url('js/min/bootstrap.bundle.min.js') }}"></script>
+      <script src="{{ static_url('js/src/form-confirm.js') }}"></script>
     {% endblock javascripts %}
   </body>
 </html>


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org