Adding post coments deletion feature at issue2 page

OWASP-BLT · Oct 21, 2023 · a186345 · a186345
1 parent a3a8d98
commit a186345
Show file tree

Hide file tree

Showing 3 changed files with 61 additions and 5 deletions.
diff --git a/blt/urls.py b/blt/urls.py
@@ -312,6 +312,8 @@
     path("issue/<str:issue_pk>/comment/", website.views.comment_on_issue, name="comment_on_issue"),
     # UPDATE COMMENT
     path("issue/<str:issue_pk>/comment/update/<str:comment_pk>/", website.views.update_comment, name="update_comment"),
+    # delete_comment 
+    path("issue2/comment/delete/", website.views.delete_comment, name="delete_comment"),
     re_path(r"^issue/(?P<slug>\w+)/$", IssueView.as_view(), name="issue_view"),
     re_path(r"^issue2/(?P<slug>\w+)/$", IssueView2.as_view(), name="issue_view2"),
     re_path(r"^follow/(?P<user>[^/]+)/", website.views.follow_user, name="follow_user"),

diff --git a/website/templates/comments2.html b/website/templates/comments2.html
@@ -80,8 +80,7 @@ <h2 class="text-xl lg:text-3xl font-bold text-gray-900 ">Comments ({{ all_commen
                                         <a class="block py-2 px-4 hover:bg-gray-100 edit_comment cursor-pointer" data-name="{{comment.id}}">Edit</a>
                                     </li>
                                     <li>
-                                        <a href="#"
-                                            class="block py-2 px-4 hover:bg-gray-100  ">Delete</a>
+                                        <a class="block py-2 px-4 hover:bg-gray-100 del_comment_issue2 cursor-pointer" data-name="{{ comment.id }}">Delete</a>
                                     </li>
                                     <li>
                                         <a href="#"
@@ -139,8 +138,7 @@ <h2 class="text-xl lg:text-3xl font-bold text-gray-900 ">Comments ({{ all_commen
                                                 <a class="block py-2 px-4 hover:bg-gray-100 edit_comment cursor-pointer" data-name="{{child_comment.id}}">Edit</a>
                                             </li>
                                             <li>
-                                                <a href="#"
-                                                    class="block py-2 px-4 hover:bg-gray-100  ">Delete</a>
+                                                <a class="block py-2 px-4 hover:bg-gray-100 del_comment_issue2 cursor-pointer" data-name="{{ child_comment.id }}">Delete</a>
                                             </li>
                                             <li>
                                                 <a href="#"
@@ -221,7 +219,7 @@ <h2 class="text-xl lg:text-3xl font-bold text-gray-900 ">Comments ({{ all_commen
                         xhr.setRequestHeader("X-CSRFToken", csrftoken); // Set the CSRF token in the request header
                 },
                 success: function (data) {
-                    $('#comment_root').html(data);
+                    $('#comment_root').replaceWith(data);
                     document.querySelectorAll("[data-dropdown-toggle]").forEach((toggle) => {
                         toggle.addEventListener("click", () => {
                             const { dropdownToggle } = toggle.dataset;
@@ -300,6 +298,44 @@ <h2 class="text-xl lg:text-3xl font-bold text-gray-900 ">Comments ({{ all_commen
             // Bind a new click event for the update_comment_btn
             $('#update_comment_btn').off('click').on('click', (e) => update_comment(e, comment_id));
         });
+        $('body').off('click', '.del_comment_issue2').on('click', '.del_comment_issue2', function (e) {
+            e.preventDefault();
+
+            // Store a reference to the clicked element
+            var clickedElement = $(this);
+            if (confirm("Delete this comment?") == true) {
+                var csrftoken = $("[name=csrfmiddlewaretoken]").val();
+
+                $.ajax({
+                    type: 'POST',
+                    url: "/issue2/comment/delete/",
+                    data: {
+                        "comment_pk": clickedElement.attr('data-name'),
+                        "issue_pk": '{{ object.pk|safe }}',
+                    },
+                    beforeSend: function (xhr, settings) {
+                        xhr.setRequestHeader("X-CSRFToken", csrftoken); // Set the CSRF token in the request header
+                    },
+                    success: function (data) {
+                        // Replace the content of #comment_root with the new data
+                        $('#comment_root').replaceWith(data);
+
+                        document.querySelectorAll("[data-dropdown-toggle]").forEach((toggle) => {
+                            toggle.addEventListener("click", () => {
+                                const { dropdownToggle } = toggle.dataset;
+                                const dropdown = document.getElementById(dropdownToggle);
+                                dropdown.classList.toggle("hidden");
+                                dropdown.classList.toggle("block");
+                                dropdown.style.position = "absolute";
+                                dropdown.style.top = toggle.offsetTop + toggle.offsetHeight + "px";
+                                dropdown.style.left = toggle.offsetLeft - 50 + "px";
+
+                            });
+                        });
+                    },
+                });
+            }
+        });
         // refresh comments after x interval
         // function get_comments(){
         //     let issue_pk = '{{ object.pk|safe }}';

diff --git a/website/views.py b/website/views.py
@@ -2047,6 +2047,24 @@ def update_comment(request, issue_pk, comment_pk):
     }
     return render(request, "comments2.html",context)
 
+def delete_comment(request):
+    int_issue_pk = int(request.POST['issue_pk'])
+    issue = Issue.objects.get(pk=int_issue_pk)
+    if request.method == "POST":
+        all_comment = Comment.objects.filter(issue=issue)
+        comment = Comment.objects.get(pk=int(request.POST['comment_pk']))
+        if request.user.username != comment.author:
+            return HttpResponse("You are not authorized to delete this comment")
+        try:
+            show = comment.parent.pk
+        except:
+            show = -1
+        comment.delete()
+    context = {
+        "all_comment": Comment.objects.filter(issue__id=int_issue_pk).order_by("-created_date"),
+        "object": issue,
+    }
+    return render(request, "comments2.html", context)
 class CustomObtainAuthToken(ObtainAuthToken):
     def post(self, request, *args, **kwargs):
         response = super(CustomObtainAuthToken, self).post(request, *args, **kwargs)