From d71b451eef449b627f27c952d6664e93ca130785 Mon Sep 17 00:00:00 2001
From: Mouse Reeve <mousereeve@riseup.net>
Date: Tue, 10 Nov 2020 21:45:22 -0800
Subject: [PATCH] More model ids in urls

---
 bookwyrm/templates/snippets/finish_reading_modal.html |  3 +--
 bookwyrm/templates/snippets/start_reading_modal.html  |  3 +--
 bookwyrm/urls.py                                      |  6 +++---
 bookwyrm/view_actions.py                              | 10 ++++------
 4 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/bookwyrm/templates/snippets/finish_reading_modal.html b/bookwyrm/templates/snippets/finish_reading_modal.html
index 5002a647..8f8aeeff 100644
--- a/bookwyrm/templates/snippets/finish_reading_modal.html
+++ b/bookwyrm/templates/snippets/finish_reading_modal.html
@@ -9,10 +9,9 @@
                 <label class="delete" for="finish-reading-{{ uuid }}" aria-label="close" role="button"></label>
             </header>
             {% active_read_through book user as readthrough %}
-            <form name="finish-reading" action="/finish-reading" method="post">
+            <form name="finish-reading" action="/finish-reading/{{ book.id }}" method="post">
                 <section class="modal-card-body">
                     {% csrf_token %}
-                    <input type="hidden" name="book" value="{{ book.id }}">
                     <input type="hidden" name="id" value="{{ readthrough.id }}">
                     <div class="field">
                         <label class="label">
diff --git a/bookwyrm/templates/snippets/start_reading_modal.html b/bookwyrm/templates/snippets/start_reading_modal.html
index 827e6d7c..4518af4f 100644
--- a/bookwyrm/templates/snippets/start_reading_modal.html
+++ b/bookwyrm/templates/snippets/start_reading_modal.html
@@ -7,10 +7,9 @@
                 <p class="modal-card-title">Start "{{ book.title }}"</p>
                 <label class="delete" for="start-reading-{{ uuid }}" aria-label="close" role="button" tabindex="0"></label>
             </header>
-            <form name="start-reading" action="/start-reading" method="post">
+            <form name="start-reading" action="/start-reading/{{ book.id }}" method="post">
                 <section class="modal-card-body">
                     {% csrf_token %}
-                    <input type="hidden" name="book" value="{{ book.id }}">
                     <div class="field">
                         <label class="label">
                             Started reading
diff --git a/bookwyrm/urls.py b/bookwyrm/urls.py
index 1f2f67d8..58eb5bd4 100644
--- a/bookwyrm/urls.py
+++ b/bookwyrm/urls.py
@@ -118,15 +118,15 @@ urlpatterns = [
     re_path(r'^boost/(?P<status_id>\d+)/?$', actions.boost),
     re_path(r'^unboost/(?P<status_id>\d+)/?$', actions.unboost),
 
-    re_path(r'^delete-status/?$', actions.delete_status),
+    re_path(r'^delete-status/(?P<status_id>\d+)/?$', actions.delete_status),
 
     re_path(r'^create-shelf/?$', actions.create_shelf),
     re_path(r'^edit-shelf/(?P<shelf_id>\d+)?$', actions.edit_shelf),
     re_path(r'^delete-shelf/(?P<shelf_id>\d+)?$', actions.delete_shelf),
     re_path(r'^shelve/?$', actions.shelve),
     re_path(r'^unshelve/?$', actions.unshelve),
-    re_path(r'^start-reading/?$', actions.start_reading),
-    re_path(r'^finish-reading/?$', actions.finish_reading),
+    re_path(r'^start-reading/(?P<book_id>\d+)/?$', actions.start_reading),
+    re_path(r'^finish-reading/(?P<book_id>\d+)/?$', actions.finish_reading),
 
     re_path(r'^follow/?$', actions.follow),
     re_path(r'^unfollow/?$', actions.unfollow),
diff --git a/bookwyrm/view_actions.py b/bookwyrm/view_actions.py
index 69c9649b..cf9af2a3 100644
--- a/bookwyrm/view_actions.py
+++ b/bookwyrm/view_actions.py
@@ -345,9 +345,9 @@ def unshelve(request):
 
 
 @login_required
-def start_reading(request):
+def start_reading(request, book_id):
     ''' begin reading a book '''
-    book = books_manager.get_edition(request.POST['book'])
+    book = books_manager.get_edition(book_id)
     shelf = models.Shelf.objects.filter(
         identifier='reading',
         user=request.user
@@ -380,9 +380,9 @@ def start_reading(request):
 
 
 @login_required
-def finish_reading(request):
+def finish_reading(request, book_id):
     ''' a user completed a book, yay '''
-    book = books_manager.get_edition(request.POST['book'])
+    book = books_manager.get_edition(book_id)
     shelf = models.Shelf.objects.filter(
         identifier='read',
         user=request.user
@@ -551,8 +551,6 @@ def unboost(request, status_id):
 @login_required
 def delete_status(request, status_id):
     ''' delete and tombstone a status '''
-    if not status_id:
-        return HttpResponseBadRequest()
     status = get_object_or_404(models.Status, id=status_id)
 
     # don't let people delete other people's statuses