From f4e1f829c7e143bece991153b5b5aab51b7ed277 Mon Sep 17 00:00:00 2001
From: ErikPorter <none@none>
Date: Wed, 13 Jan 2010 16:58:28 +0000
Subject: [PATCH] Changed Blog delete button to be a form submit so it could be
 checked against the antiforgery token.

--HG--
extra : convert_revision : svn%3A5ff7c347-ad56-4c35-b696-ccb81de16e03/trunk%4045336
---
 .../Controllers/BlogAdminController.cs         |  2 +-
 .../Items/Blogs.Blog.DetailAdmin.ascx          | 16 +++++++++++++---
 .../Items/Blogs.Blog.SummaryAdmin.ascx         | 18 ++++++++++++------
 src/Orchard/UI/PageTitle/PageTitleBuilder.cs   |  1 -
 4 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/src/Orchard.Web/Packages/Orchard.Blogs/Controllers/BlogAdminController.cs b/src/Orchard.Web/Packages/Orchard.Blogs/Controllers/BlogAdminController.cs
index fe6d0a4af..4ddd6c191 100644
--- a/src/Orchard.Web/Packages/Orchard.Blogs/Controllers/BlogAdminController.cs
+++ b/src/Orchard.Web/Packages/Orchard.Blogs/Controllers/BlogAdminController.cs
@@ -109,7 +109,7 @@ namespace Orchard.Blogs.Controllers {
             return Redirect(Url.BlogsForAdmin());
         }
 
-        //[HttpPost] <- todo: (heskew) make all add/edit/remove POST only and verify the AntiForgeryToken
+        [HttpPost]
         public ActionResult Delete(string blogSlug) {
             if (!_authorizer.Authorize(Permissions.DeleteBlog, T("Couldn't delete blog")))
                 return new HttpUnauthorizedResult();
diff --git a/src/Orchard.Web/Packages/Orchard.Blogs/Views/DisplayTemplates/Items/Blogs.Blog.DetailAdmin.ascx b/src/Orchard.Web/Packages/Orchard.Blogs/Views/DisplayTemplates/Items/Blogs.Blog.DetailAdmin.ascx
index 4121965e9..d78599f98 100644
--- a/src/Orchard.Web/Packages/Orchard.Blogs/Views/DisplayTemplates/Items/Blogs.Blog.DetailAdmin.ascx
+++ b/src/Orchard.Web/Packages/Orchard.Blogs/Views/DisplayTemplates/Items/Blogs.Blog.DetailAdmin.ascx
@@ -2,11 +2,21 @@
 <%@ Import Namespace="Orchard.Mvc.ViewModels"%>
 <%@ Import Namespace="Orchard.Blogs.Extensions"%>
 <%@ Import Namespace="Orchard.Blogs.Models"%>
-<%-- todo: (heskew) get what actions we can out of the h2 :| --%>
 <h1 class="withActions">
     <a href="<%=Url.BlogForAdmin(Model.Item.Slug) %>"><%=Html.TitleForPage(Model.Item.Name) %></a>
-    <a href="<%=Url.BlogEdit(Model.Item.Slug) %>" class="ibutton edit"><%=_Encoded("Edit Blog") %></a>
-    <span class="actions"><span class="destruct"><a href="<%=Url.BlogDelete(Model.Item.Slug) %>" class="ibutton remove"><%=_Encoded("Remove Blog") %></a></span></span></h1>
+</h1>
+<ul class="actions">
+    <li class="construct">
+        <a href="<%=Url.BlogEdit(Model.Item.Slug) %>" class="ibutton edit"><%=_Encoded("Edit Blog") %></a>
+    </li>
+    <li class="destruct">
+        <% using (Html.BeginFormAntiForgeryPost(Url.BlogDelete(Model.Item.Slug))) { %>
+            <fieldset>
+                <input type="image" src="<%=Html.ThemePath("/styles/images/remove.png") %>" alt="<%=_Encoded("Remove Blog") %>" title="<%=_Encoded("Remove Blog") %>" class="ibutton image remove" />
+            </fieldset><%
+        } %>
+    </li>
+</ul>
 <p><%=Html.Encode(Model.Item.Description) %></p>
 <div class="actions"><a href="<%=Url.BlogPostCreate(Model.Item.Slug) %>" class="add button"><%=_Encoded("New Post")%></a></div>
 <% Html.Zone("primary");
diff --git a/src/Orchard.Web/Packages/Orchard.Blogs/Views/DisplayTemplates/Items/Blogs.Blog.SummaryAdmin.ascx b/src/Orchard.Web/Packages/Orchard.Blogs/Views/DisplayTemplates/Items/Blogs.Blog.SummaryAdmin.ascx
index 1d2156000..2d82764d7 100644
--- a/src/Orchard.Web/Packages/Orchard.Blogs/Views/DisplayTemplates/Items/Blogs.Blog.SummaryAdmin.ascx
+++ b/src/Orchard.Web/Packages/Orchard.Blogs/Views/DisplayTemplates/Items/Blogs.Blog.SummaryAdmin.ascx
@@ -5,17 +5,23 @@
 <h2><%=Html.Link(Html.Encode(Model.Item.Name), Url.BlogForAdmin(Model.Item.Slug)) %></h2>
 <div class="meta">
     <%=Html.Link(_Encoded("{0} post{1}", Model.Item.PostCount, Model.Item.PostCount == 1 ? "" : "s").ToString(), Url.BlogForAdmin(Model.Item.Slug))%>
-    | <%=Html.Link(_Encoded("?? comments").ToString(), "") %></a>
+    | <%=Html.Link(_Encoded("?? comments").ToString(), "") %>
 </div>
 <%--<p>[list of authors] [modify blog access]</p>--%>
 <p><%=Html.Encode(Model.Item.Description) %></p>
-<p class="actions">
+<ul class="actions">
     <%-- todo: (heskew) make into a ul --%>
-    <span class="construct">
+    <li class="construct">
         <a href="<%=Url.BlogForAdmin(Model.Item.Slug) %>" class="ibutton blog"><%=_Encoded("Manage Blog") %></a>
         <a href="<%=Url.BlogEdit(Model.Item.Slug) %>" class="ibutton edit"><%=_Encoded("Edit Blog")%></a>
         <a href="<%=Url.Blog(Model.Item.Slug) %>" class="ibutton view"><%=_Encoded("View Blog")%></a>
         <a href="<%=Url.BlogPostCreate(Model.Item.Slug) %>" class="ibutton add page"><%=_Encoded("New Post")%></a>
-    </span>
-    <span class="destruct"><a href="<%=Url.BlogDelete(Model.Item.Slug) %>" class="ibutton remove"><%=_Encoded("Remove Blog")%></a></span>
-</p>
\ No newline at end of file
+    </li>
+    <li class="destruct">
+        <% using (Html.BeginFormAntiForgeryPost(Url.BlogDelete(Model.Item.Slug))) { %>
+            <fieldset>
+                <input type="image" src="<%=Html.ThemePath("/styles/images/remove.png") %>" alt="<%=_Encoded("Remove Blog") %>" title="<%=_Encoded("Remove Blog") %>" class="ibutton image remove" />
+            </fieldset><%
+        } %>
+    </li>
+</ul>
\ No newline at end of file
diff --git a/src/Orchard/UI/PageTitle/PageTitleBuilder.cs b/src/Orchard/UI/PageTitle/PageTitleBuilder.cs
index 4af34ae7f..090e3377f 100644
--- a/src/Orchard/UI/PageTitle/PageTitleBuilder.cs
+++ b/src/Orchard/UI/PageTitle/PageTitleBuilder.cs
@@ -11,7 +11,6 @@ namespace Orchard.UI.PageTitle {
         public PageTitleBuilder(ISiteService siteService) {
             _siteService = siteService;
             _titleParts = new List<string>(5);
-            //TODO: (erikpo) Get this from a site setting
             _titleSeparator = _siteService.GetSiteSettings().PageTitleSeparator;
         }