From bf0bee402b4852db2f7b79505b9b10b2533acd08 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 20 2019 10:11:31 +0000
Subject: [PATCH 1/5] Move the wait_for_task function down and fix the call to setTimeout


Move the function wait_for_task lower down in the file so all the
functions about viewing the stats are in one place and the functions
about retrieving the data at the bottom.

Fix the call to window.setTimeout so it works with the CSP headers

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/static/issues_stats.js b/pagure/static/issues_stats.js
index 8b861f1..b8e63b9 100644
--- a/pagure/static/issues_stats.js
+++ b/pagure/static/issues_stats.js
@@ -57,17 +57,6 @@ function issues_history_stats_plot(url, _b, _s) {
   });
 }
 
-function wait_for_task(url, callback) {
-  $.get(url)
-  .done(function(data){
-    callback(data);
-    $("#data_stats_spinner").hide();
-  })
-  .fail(function(){
-    window.setTimeout(wait_for_task(url, callback), 1000);
-  });
-}
-
 function show_commits_authors(data) {
   var _b = $("#data_stats");
   var html = '<h2>Authors stats</h2><p> Since '
@@ -157,3 +146,14 @@ function process_async(url, _data, callback) {
     wait_for_task(data.url, callback);
   })
 }
+
+function wait_for_task(url, callback) {
+  $.get(url)
+  .done(function(data){
+    callback(data);
+    $("#data_stats_spinner").hide();
+  })
+  .fail(function(){
+    window.setTimeout(function() {wait_for_task(url, callback);}, 1000);
+  });
+}

From b5b97e72feced3eb88551efdd8f4d99220e0677f Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 20 2019 10:13:01 +0000
Subject: [PATCH 2/5] Fix the id vs class in the repo_stats template


The id is either data_stats_spinner or data_stats and hidden is supposed
to be a class, not an id.

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/templates/repo_stats.html b/pagure/templates/repo_stats.html
index d25fe4e..58aa147 100644
--- a/pagure/templates/repo_stats.html
+++ b/pagure/templates/repo_stats.html
@@ -28,8 +28,8 @@
     </div>
     <div class="col-10">
       <section id="stats">
-        <span id="data_stats_spinner hidden"></span>
-        <span id="data_stats hidden"></span>
+        <span id="data_stats_spinner" class="hidden"></span>
+        <span id="data_stats" class="hidden"></span>
       </section>
     </div>
   </div>

From e0075514d6db72728d9dfeddd35f78e36d74f104 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 20 2019 10:13:53 +0000
Subject: [PATCH 3/5] Fix typo in the id name: publicnotifications != publicnotificationsb


Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/templates/settings.html b/pagure/templates/settings.html
index ec954c6..1067f35 100644
--- a/pagure/templates/settings.html
+++ b/pagure/templates/settings.html
@@ -31,7 +31,7 @@
                 href="#apikeys-tab" role="tab" aria-controls="apikeys">API Keys</a>
           <a class="nav-item nav-link" id="projectoptions" data-toggle="tab"
                 href="#projectoptions-tab" role="tab" aria-controls="projectoptions">Project Options</a>
-          <a class="nav-item nav-link" id="publicnotificationsb" data-toggle="tab"
+          <a class="nav-item nav-link" id="publicnotifications" data-toggle="tab"
                 href="#publicnotifications-tab" role="tab" aria-controls="publicnotifications">Public Notifications</a>
 
           {% if config.get('ENABLE_USER_MNGT', True) %}

From 36de818edb283b7d49ff15603a67c9ce3712018e Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 20 2019 13:20:25 +0000
Subject: [PATCH 4/5] Drop all the inline "onclick()" calls


These calls do not work with CSP headers

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/templates/_formhelper.html b/pagure/templates/_formhelper.html
index f33e3f3..8bdd299 100644
--- a/pagure/templates/_formhelper.html
+++ b/pagure/templates/_formhelper.html
@@ -130,7 +130,7 @@
             }}">commented
             {% if PRinline %}
             on line <a href="#c-{{ comment.commit_id }}-{{ comment.line }}"
-                        onclick="showTab()">{{
+                        class="inline_comment_link_btn">{{
                         comment.line }} of {{ comment.filename }}</a>
             {% endif %}
             {{ comment.date_created | humanize}}</span>
@@ -176,9 +176,8 @@
             {% if id != 0 and g.fas_user and (g.repo_committer or (
                 comment.parent.status in [True, 'Open']
                 and g.fas_user.username == comment.user.username)) %}
-            <button class="btn btn-outline-primary border-0" type="submit"
+            <button class="btn btn-outline-primary border-0 delete_comment_btn" type="submit"
                 name="drop_comment" value="{{ comment.id }}"
-                onclick="return confirm('Do you really want to remove this comment?');"
                 title="Remove comment">
               <i class="fa fa-trash"></i>
             </button>
diff --git a/pagure/templates/add_deploykey.html b/pagure/templates/add_deploykey.html
index fa152aa..f69fccb 100644
--- a/pagure/templates/add_deploykey.html
+++ b/pagure/templates/add_deploykey.html
@@ -29,7 +29,7 @@
       {{ render_bootstrap_field(form.pushaccess, field_description="Do you want to give this key push access?") }}
 
       <p class="buttons indent">
-        <input type="button" value="Cancel" class="btn btn-secondary" onclick="history.back();">
+        <input type="button" value="Cancel" class="btn btn-secondary cancel_btn">
         <input type="submit" class="btn btn-primary" value="Add">
         {{ form.csrf_token }}
       </p>
diff --git a/pagure/templates/add_group.html b/pagure/templates/add_group.html
index e6376f6..a369583 100644
--- a/pagure/templates/add_group.html
+++ b/pagure/templates/add_group.html
@@ -24,7 +24,7 @@
             {%- endif %}
             <p class="buttons indent">
               <input class="submit positive btn btn-primary" type="submit" value="Create" >
-              <input type="button" value="Cancel" class="btn btn-default" onclick="history.back();">
+              <input type="button" value="Cancel" class="btn btn-default cancel_btn">
               {{ form.csrf_token }}
             </p>
           </form>
diff --git a/pagure/templates/add_group_project.html b/pagure/templates/add_group_project.html
index f792f05..e69d19e 100644
--- a/pagure/templates/add_group_project.html
+++ b/pagure/templates/add_group_project.html
@@ -36,7 +36,7 @@
       </fieldset>
 
       <p class="buttons indent">
-        <input type="button" value="Cancel" class="btn btn-secondary" onclick="history.back();">
+        <input type="button" value="Cancel" class="btn btn-secondary cancel_btn">
         <input type="submit" class="btn btn-primary" id="add_update_button" value="Add">
         {{ form.csrf_token }}
       </p>
diff --git a/pagure/templates/add_token.html b/pagure/templates/add_token.html
index fe2e3d1..7ea5bf3 100644
--- a/pagure/templates/add_token.html
+++ b/pagure/templates/add_token.html
@@ -56,7 +56,7 @@
             <a class="btn btn-secondary" href="{{ url_for('ui_ns.user_settings')
                 }}#nav-api-tab">Cancel</a>
             {% endif %}
-            <span class="btn" onclick="toggle()">Toggle all</span>
+            <span class="btn toggle_all">Toggle all</span>
             {{ form.csrf_token }}
           </div>
         </form>
@@ -73,6 +73,9 @@
       checkboxes[i].checked = !checkboxes[i].checked;
     }
   }
+  document.addEventListener('DOMContentLoaded', function () {
+    document.querySelector('.toggle_all').addEventListener('click', toggle);
+  });
 </script>
 {% endmacro %}
 
diff --git a/pagure/templates/add_user.html b/pagure/templates/add_user.html
index 7815057..a4bd4e8 100644
--- a/pagure/templates/add_user.html
+++ b/pagure/templates/add_user.html
@@ -34,7 +34,7 @@
       </fieldset>
 
       <p class="buttons indent">
-        <input type="button" value="Cancel" class="btn btn-secondary" onclick="history.back();">
+        <input type="button" value="Cancel" class="btn btn-secondary cancel_btn">
         <input type="submit" class="btn btn-primary" id="add_update_button" value="Add">
         {{ form.csrf_token }}
       </p>
diff --git a/pagure/templates/blame.html b/pagure/templates/blame.html
index 8d79965..05be5e4 100644
--- a/pagure/templates/blame.html
+++ b/pagure/templates/blame.html
@@ -120,8 +120,7 @@
           username=username,
           namespace=repo.namespace,
           branchname=branchname, filename=filename) }}">
-        <button class="btn btn-sm btn-secondary"
-          onclick="fork_project.submit();">
+        <button class="btn btn-sm btn-secondary fork_project_btn">
             Fork and Edit
         </button>
         {{ forkbuttonform.csrf_token }}
@@ -199,6 +198,8 @@ function updateHighlight() {
   return [];
 }
 $(document).ready(function () {
+  $('.fork_project_btn').click($("[name=fork_project]").submit);
+
   var lines = updateHighlight();
   if (lines) {
     var offset = $('[data-line-number=' + lines[0] + ']').offset().top;
diff --git a/pagure/templates/comment_update.html b/pagure/templates/comment_update.html
index 51c79c7..d293138 100644
--- a/pagure/templates/comment_update.html
+++ b/pagure/templates/comment_update.html
@@ -31,8 +31,7 @@
     <div>
       <input type="hidden" name="edit_comment" value="{{ comment.id }}" />
       <input type="submit" class="btn btn-primary" value="Update" />
-      <input type="button" id="comment_update_cancel" class="btn btn-secondary cancel" value="Cancel" {% if not is_js -%}
-        onclick="history.back();"{% endif %} />
+      <input type="button" id="comment_update_cancel" class="btn btn-secondary cancel cancel_btn" value="Cancel" />
     </div>
 
   </form>
diff --git a/pagure/templates/edit_file.html b/pagure/templates/edit_file.html
index 2aeb71f..f4e0218 100644
--- a/pagure/templates/edit_file.html
+++ b/pagure/templates/edit_file.html
@@ -102,7 +102,7 @@
       </fieldset>
       <div>
         <input type="submit" class="btn btn-primary" value="Commit changes">
-        <input type="button" class="btn btn-secondary" value="Cancel" class="button" onclick="history.back();">
+        <input type="button" class="btn btn-secondary" value="Cancel" class="button cancel_btn">
       </div>
     </div>
 
diff --git a/pagure/templates/edit_group.html b/pagure/templates/edit_group.html
index f011c69..3db287c 100644
--- a/pagure/templates/edit_group.html
+++ b/pagure/templates/edit_group.html
@@ -56,8 +56,7 @@
             {{ form.csrf_token }}
             <input class="form-control" name="username" id="user"
               placeholder="Start typing to search users" value=""/>
-            <button class="btn btn-danger" type="submit"
-              onclick="return confirm('Are you sure to give {{ group.group_name }}? \nThis is final and cannot be un-done.');"
+            <button class="btn btn-danger give_group_btn" type="submit"
               title="Give the group to someone">
                 <i class="fa fa-share-square-o"></i>&nbsp; Give the {{ group.group_name }} group
             </button>
@@ -98,5 +97,9 @@ $('#user').selectize({
     );
   }
 });
+
+$('.give_group_btn').click(function() {
+  return confirm('Are you sure to give {{ group.group_name }}? \nThis is final and cannot be un-done.');
+})
 </script>
 {% endblock %}
diff --git a/pagure/templates/edit_tag.html b/pagure/templates/edit_tag.html
index 232f38b..72490f4 100644
--- a/pagure/templates/edit_tag.html
+++ b/pagure/templates/edit_tag.html
@@ -45,8 +45,8 @@
             </div>
           </fieldset>
           <input type="submit" class="btn btn-primary" value="Update Tag" />
-          <input type="button" class="btn btn-secondary pull-md-right"
-            value="Cancel" onclick="history.back();" />
+          <input type="button" class="btn btn-secondary pull-md-right cancel_btn"
+            value="Cancel"/>
         </form>
       </div>
     </div>
diff --git a/pagure/templates/file.html b/pagure/templates/file.html
index 8ca23c5..d778c76 100644
--- a/pagure/templates/file.html
+++ b/pagure/templates/file.html
@@ -127,8 +127,7 @@
                         username=username,
                         namespace=repo.namespace,
                         branchname=branchname, filename=filename) }}">
-                    <button class="btn btn-sm btn-secondary"
-                        onclick="fork_project.submit();">
+                    <button class="btn btn-sm btn-secondary fork_project_btn">
                             {% if g.repo_forked %}
                             Edit in your fork
                             {% else %}
@@ -268,6 +267,8 @@ No content found in this repository
 
 <script type="text/javascript" nonce="{{ g.nonce }}">
   $(document).ready(function() {
+  $('.fork_project_btn').click($("[name=fork_project]").submit);
+
   $('pre.syntaxhighlightblock code').each(function(i, block) {
     hljs.highlightBlock(block);
     hljs.lineNumbersBlock(block);
@@ -276,6 +277,7 @@ No content found in this repository
 </script>
 
 <script type="text/javascript" nonce="{{ g.nonce }}">
+
   function updateHighlight() {
     var cls = "highlighted-line";
     $('.' + cls).removeClass(cls)
diff --git a/pagure/templates/group_info.html b/pagure/templates/group_info.html
index 833de6d..36a2f71 100644
--- a/pagure/templates/group_info.html
+++ b/pagure/templates/group_info.html
@@ -34,10 +34,8 @@
                 class="btn btn-sm btn-outline-primary">
                 <span class="fa fa-pencil" title="Edit group"></span>&nbsp;Edit
             </a>
-              <button
-                onclick="return confirm('Are you sure you want to delete the group `{{group.group_name}}`?');"
-                title="Delete group"
-                class="btn btn-sm btn-outline-danger">
+              <button title="Delete group"
+                class="btn btn-sm btn-outline-danger delete-group-btn">
                 <i class="fa fa-trash"></i> &nbsp;Delete
               </button>
             </div>
@@ -102,11 +100,9 @@
                 action="{{ url_for('ui_ns.group_user_delete',
                     group=group.group_name, user=user.user) }}">
                 {{ form.csrf_token }}
-                <button
-                  onclick="return confirm('Are you sure to remove user `{{
-                    user.user}}` from the group `{{group.group_name}}`?');"
-                  title="Remove user from group"
-                  class="btn btn-sm btn-outline-danger border-0">
+                <button title="Remove user from group"
+                  data-username="{{ user.user }}"
+                  class="btn btn-sm btn-outline-danger border-0 remove-user-btn">
                   <i class="fa fa-trash"></i>
                 </button>
               </form>
@@ -128,6 +124,12 @@
 
   <script type="text/javascript" nonce="{{ g.nonce }}">
   $(document).ready(function() {
+    $('.delete-group-btn').click(function() {
+        return confirm('Are you sure you want to delete the group `{{ group.group_name }}`?');
+    })
+    $('.remove-user-btn').click(function() {
+        return confirm('Are you sure to remove user `' + $(this).attr('data-username') + '` from the group `{{ group.group_name }}`?');
+    })
     $('#headerSearch').on('keypress keydown keyup', function(e) {
       if (e.which == 13) {
           e.preventDefault();
diff --git a/pagure/templates/issue.html b/pagure/templates/issue.html
index 80ccd2b..b47ee8f 100644
--- a/pagure/templates/issue.html
+++ b/pagure/templates/issue.html
@@ -669,6 +669,10 @@ $(document).ready(function() {
     doUpload("{{ form.csrf_token.current_token }}", this.files);
   });
 
+  $('.delete_comment_btn').click(function() {
+    return confirm('Do you really want to remove this comment?');
+  });
+
   $('.mainform #assignee').selectize({
     valueField: 'user',
     labelField: 'user',
diff --git a/pagure/templates/login/password_reset.html b/pagure/templates/login/password_reset.html
index eabd58b..cd416b4 100644
--- a/pagure/templates/login/password_reset.html
+++ b/pagure/templates/login/password_reset.html
@@ -18,7 +18,7 @@
             {{ render_bootstrap_field(form.password) }}
             {{ render_bootstrap_field(form.confirm_password) }}
             <input class="btn btn-primary" type="submit" value="Update">
-            <input type="button" value="Cancel" class="btn btn-default" onclick="history.back();">
+            <input type="button" value="Cancel" class="btn btn-default cancel_btn">
             {{ form.csrf_token }}
           </form>
         </div>
diff --git a/pagure/templates/master.html b/pagure/templates/master.html
index 18fa1af..fab6dd8 100644
--- a/pagure/templates/master.html
+++ b/pagure/templates/master.html
@@ -168,7 +168,10 @@
 
     {{theme.js_imports()}}
     <script type="text/javascript" nonce="{{ g.nonce }}">
-$('[data-toggle="tooltip"]').tooltip({placement : 'bottom'});
+      $('[data-toggle="tooltip"]').tooltip({placement : 'bottom'});
+      $(".cancel_btn").click(function() {
+        history.back();
+      });
     </script>
     {% endblock %}
 
diff --git a/pagure/templates/new_project.html b/pagure/templates/new_project.html
index b649c49..6d619e1 100644
--- a/pagure/templates/new_project.html
+++ b/pagure/templates/new_project.html
@@ -31,8 +31,8 @@
               {{ render_bootstrap_field(form.repospanner_region, field_description="repoSpanner region to create the project in") }}
             {% endif %}
             <input class="btn btn-primary" type="submit" value="Create" title="Update description">
-            <input type="button" class="btn btn-default float-right"
-              value="Cancel" onclick="history.back();">
+            <input type="button" class="btn btn-default float-right cancel_btn"
+              value="Cancel">
             {{ form.csrf_token }}
           </form>
         </div>
diff --git a/pagure/templates/plugin.html b/pagure/templates/plugin.html
index 0e77e6a..304ed3e 100644
--- a/pagure/templates/plugin.html
+++ b/pagure/templates/plugin.html
@@ -32,7 +32,7 @@
   {{ plugin.extra_info | render(repo=repo, username=username) | safe }}
   {% endif %}
   <p class="buttons indent">
-      <input type="button" value="Cancel" class="btn btn-secondary" onclick="history.back();">
+      <input type="button" value="Cancel" class="btn btn-secondary cancel_btn">
       <input type="submit" class="btn btn-primary" value="Update">
       {{ form.csrf_token }}
     </p>
diff --git a/pagure/templates/repo_branches.html b/pagure/templates/repo_branches.html
index 3880b5b..d2f2afa 100644
--- a/pagure/templates/repo_branches.html
+++ b/pagure/templates/repo_branches.html
@@ -85,15 +85,15 @@
                             username=username,
                             namespace=repo.namespace,
                             branchname=branch)
-                    }}" method="post" class="icon d-inline"
-                    onsubmit="return confirm('Are you sure you want to remove the branch: {{ branch | unicode }}?\nThis cannot be un-done!');">
+                    }}" method="post" class="icon d-inline delete-branch-form"
+                    data-branch-name="{{ branch | unicode }}">
                     {{ g.confirmationform.csrf_token }}
                     <a title="Remove branch {{ branch | unicode }}" href="#"
-                      class="btn btn-outline-danger"
-                      onclick="$('#delete_branch_form-{{
+                      class="btn btn-outline-danger delete-branch-btn"
+                      data-branch-name="{{
                         branch | unicode | replace('/', '__') | replace('.', '\\\\.')
                         | replace('+', '___')
-                        }}').submit();">
+                        }}">
                       <i class="fa fa-trash"></i>
                     </a>
                   </form>
@@ -113,6 +113,16 @@
 <script type="text/javascript" nonce="{{ g.nonce }}">
 $(function() {
   {% if g.authenticated and g.repo_committer %}
+
+  $(".delete-branch-btn").click(function() {
+    $('#delete_branch_form-' + $(this).attr("data-branch-name")).submit()
+  });
+
+  $(".delete-branch-form").submit(function() {
+    console.log($(this));
+    return confirm('Are you sure you want to remove the branch: ' + $(this).attr("data-branch-name") + '?\nThis cannot be un-done!');
+  });
+
   var _cnt = 0;
 
   function set_up_branch_pr_info(res) {
diff --git a/pagure/templates/repo_info.html b/pagure/templates/repo_info.html
index dd44617..75f01e7 100644
--- a/pagure/templates/repo_info.html
+++ b/pagure/templates/repo_info.html
@@ -86,8 +86,7 @@
             </div>
             <div class="btn-group">
                 {% if g.authenticated and not g.repo_starred %}
-                  <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
-                    onclick="$('#star_project').submit();">
+                  <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold star_btn">
                     <form method="POST" name="star_project" id="star_project"
                       action="{{ url_for(
                       'ui_ns.star_project',
@@ -106,8 +105,7 @@
                                 namespace=repo.namespace,
                     )}}" class="btn btn-sm btn-primary font-weight-bold">{{ repo.stargazers|length }}</a>
                 {% elif g.authenticated and g.repo_starred %}
-                  <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold"
-                    onclick="$('#unstar_project').submit();">
+                  <a href="#" class="btn btn-sm btn-outline-primary font-weight-bold unstar_btn">
                     <form method="POST" name="unstar_project" id="unstar_project"
                       action="{{ url_for(
                       'ui_ns.star_project',
@@ -342,6 +340,8 @@ git push -u origin master</pre>
 {{ super() }}
 <script type="text/javascript" nonce="{{ g.nonce }}">
 $(document).ready(function() {
+    $('.star_btn').click( function() { $('#star_project').submit()} );
+    $('.unstar_btn').click( function() { $('#unstar_project').submit()} );
     {% if g.repo_watch_levels %}
         var currentWatchStatusButton = $('#watch_{{ g.repo_watch_levels | join('_') }}_button .check-icon span');
     {% else %}
diff --git a/pagure/templates/repo_master.html b/pagure/templates/repo_master.html
index f30cfc6..58c8e29 100644
--- a/pagure/templates/repo_master.html
+++ b/pagure/templates/repo_master.html
@@ -167,8 +167,7 @@
                 namespace=repo.namespace) }}">
               {{ g.forkbuttonform.csrf_token }}
             </form>
-              <button class="btn btn-sm btn-outline-primary"
-              onclick="$('#fork_project').submit();">
+              <button class="btn btn-sm btn-outline-primary fork_project_btn">
               <i class="fa fa-code-fork fa-fw"></i> Fork</button>
             {% endif %}
           </div>
@@ -304,6 +303,11 @@ $("#giturl-toggle").on('click', function(event){
   $("#giturl-more").toggle();
   $("#giturl-toggle").hide();
 })
+
+$(".fork_project_btn").click(function() {
+  $('#fork_project').submit();
+});
+
 {% if g.authenticated and not g.repo_obj.is_empty %}
 
 {% if g.repo_committer %}
diff --git a/pagure/templates/repo_new_pull_request.html b/pagure/templates/repo_new_pull_request.html
index 0ab51c1..17b09a2 100644
--- a/pagure/templates/repo_new_pull_request.html
+++ b/pagure/templates/repo_new_pull_request.html
@@ -387,6 +387,10 @@ function showTab(){
 
 
 $(document).ready(function() {
+  $('.inline_comment_link_btn').click(function() { showTab() });
+  $('.delete_comment_btn').click(function() {
+    return confirm('Do you really want to remove this comment?');
+  });
 
   $('.branch_from_item').click(function(e){
     {% if remote_git and not (config.get('DISABLE_REMOTE_PR', True)) %}
diff --git a/pagure/templates/repo_pull_request.html b/pagure/templates/repo_pull_request.html
index bba3e57..2ea8a44 100644
--- a/pagure/templates/repo_pull_request.html
+++ b/pagure/templates/repo_pull_request.html
@@ -187,7 +187,6 @@
                   }}" method="POST"  id="merge_pr_form">
                   {{ mergeform.csrf_token }}
                   <button id="merge_btn" type="submit"
-                    onclick="return confirm('Confirm merging this pull-request');"
                     class="btn btn-block my-2">Merge</button>
                   {% if can_delete_branch %}
                   <div class="small">
@@ -219,8 +218,8 @@
               {{ trigger_ci_pr_form.csrf_token }}
               {{ trigger_ci_pr_form.comment(id="ci_pr_comment", hidden=True) }}
                 {% for comment, meta in trigger_ci|dictsort %}
-                  <a class="dropdown-item" href="#" title="{{ meta["description"] }}"
-                  onclick="$('#ci_pr_comment').val('{{ comment }}'); $('#ci_pr_trigger_form').submit()">{{ meta["name"] }}</a>
+                  <a class="dropdown-item trigger-ci-btn" href="#" title="{{ meta["description"] }}"
+                  data-comment="{{ comment }}">{{ meta["name"] }}</a>
                 {% endfor %}
             </form>
           </div>
@@ -909,6 +908,17 @@ function show_merge_status(){
 {% endif %}
 
 $(document).ready(function() {
+  $('#merge_btn').click(function() {
+      return confirm('Confirm merging this pull-request');
+  });
+  $('.trigger-ci-btn').click(function() {
+    $('#ci_pr_comment').val($(this).attr("data-comment"));
+    $('#ci_pr_trigger_form').submit();
+  });
+  $('.inline_comment_link_btn').click(function() { showTab() });
+  $('.delete_comment_btn').click(function() {
+    return confirm('Do you really want to remove this comment?');
+  });
 
   $('#rebase_btn').click(function(){
     var _conf = confirm('Confirm rebasing this pull-request');
diff --git a/pagure/templates/settings.html b/pagure/templates/settings.html
index 1067f35..56d400d 100644
--- a/pagure/templates/settings.html
+++ b/pagure/templates/settings.html
@@ -213,10 +213,7 @@
                             username=username,
                             namespace=repo.namespace) }}"
                           method="post" class="icon">
-                      <button class="btn btn-primary" type="submit"
-                        onclick="return confirm('Are you sure to generate a new token for '
-                          + 'this project/fork? \nThis will break all web hook in place and '
-                          + 'cannot be un-done.');"
+                      <button class="btn btn-primary" type="submit" id="generate_new_hook_token"
                         title="Generate a new hook token">
                         <span class="fa fa-refresh"></span> &nbsp;Re-generate
                       </button>
@@ -359,9 +356,8 @@
                                 username=username,
                                 namespace=repo.namespace,
                                 userid=user.id) }}">
-                            <button
-                              onclick="return confirm('You sure you want to remove this user from this project?');"
-                              title="Remove user" class="btn btn-danger btn-sm">
+                            <button title="Remove user"
+                              class="btn btn-danger btn-sm remove_user_btn">
                               <i class="fa fa-trash"></i>
                             </button>
                             {{ form.csrf_token }}
@@ -395,8 +391,7 @@
                                 namespace=repo.namespace,
                                 groupid=group.id) }}">
                             <button
-                              onclick="return confirm('You sure you want to remove this group from this project?');"
-                              title="Remove group" class="btn btn-danger btn-sm pull-right">
+                              title="Remove group" class="btn btn-danger btn-sm pull-right remove_group_btn">
                               <i class="fa fa-trash"></i>
                             </button>
                             {{ form.csrf_token }}
@@ -458,8 +453,7 @@
                               namespace=repo.namespace,
                               keyid=deploykey.id) }}">
                           <button
-                            onclick="return confirm('You sure you want to remove this deploy key from this project?');"
-                            title="Remove deploy key" class="btn btn-outline-danger">
+                            title="Remove deploy key" class="btn btn-outline-danger remove_deploy_key_btn">
                             <i class="fa fa-trash"></i>
                           </button>
                           {{ form.csrf_token }}
@@ -839,8 +833,7 @@
                                 <input type="hidden" value="{{ report }}" name="report" />
                                 {{ tag_form.csrf_token }}
                                 <button
-                                  onclick="return confirm('Do you really want to remove the report: {{ report }}?');"
-                                  title="Delete report" class="btn btn-danger btn-sm">
+                                  title="Delete report" class="btn btn-danger btn-sm delete_report_btn">
                                   <i class="fa fa-trash"></i>
                                 </button>
                               </form>
@@ -887,9 +880,8 @@
                               namespace=repo.namespace) }}">
                             <input type="hidden" value="{{ tag.tag }}" name="tag" />
                             {{ tag_form.csrf_token }}
-                            <button
-                              onclick="return confirm('Do you really want to remove the tag: {{ tag.tag }}?');"
-                              title="Remove tag" class="btn btn-danger btn-sm">
+                            <button title="Remove tag" data-tag-name="{{ tag.tag }}"
+                              class="btn btn-danger btn-sm remove_tag_btn">
                               <i class="fa fa-trash"></i>
                             </button>
                           </form>
@@ -1060,8 +1052,7 @@
                     {{ tag_form.csrf_token }}
                     <input class="form-control" name="user" id="user"
                       placeholder="Start typing to search users" value=""/>
-                    <button class="btn btn-danger" type="submit"
-                      onclick="return confirm('Are you sure to give {{ repo.fullname }}? \nThis is final and cannot be un-done.');"
+                    <button class="btn btn-danger give_project_btn" type="submit"
                       title="Give the project to someone">
                         <i class="fa fa-share-square-o"></i>&nbsp; Give the {{repo.name}} project
                     </button>
@@ -1102,8 +1093,7 @@
             namespace=repo.namespace) }}"
               method="post" class="icon">
 
-            <button class="btn btn-danger" type="submit"
-              onclick="return confirm('Are you sure to delete {{ repo.fullname }}? \nThis is final and cannot be un-done.');"
+            <button class="btn btn-danger delete_project_btn" type="submit"
               title="Delete the project/fork">
                 <i class="fa fa-trash"></i>
                 &nbsp; Delete the {{ repo.fullname }} project
@@ -1149,6 +1139,53 @@ function color_tags() {
 $(document).ready(function() {
     updateform();
     color_tags();
+
+    $('#generate_new_hook_token').click(function() {
+        return confirm('Are you sure to generate a new token for '
+                          + 'this project/fork? \nThis will break all web hook in place and '
+                          + 'cannot be un-done.');
+    });
+
+    $('.remove_user_btn').click(function(){
+      return confirm('You sure you want to remove this user from this project?');
+    });
+
+    $('.remove_group_btn').click(function(){
+      return confirm('You sure you want to remove this group from this project?');
+    });
+
+    $('.remove_deploy_key_btn').click(function(){
+      return confirm('You sure you want to remove this deploy key from this project?');
+    });
+
+    $('.delete_report_btn').click(function(){
+      return confirm('Do you really want to remove the report: {{ report }}?');
+    });
+
+    $('.remove_tag_btn').click(function(){
+      var _tag = $(this).attr('data-tag-name');
+      return confirm('Do you really want to remove the tag: ' + _tag + '?');
+    });
+
+    $('.give_project_btn').click(function(){
+      return confirm('Are you sure to give {{ repo.fullname }}? \nThis is final and cannot be un-done.');
+    });
+
+    $('.delete_project_btn').click(function(){
+      return confirm('Are you sure to delete {{ repo.fullname }}? \nThis is final and cannot be un-done.');
+    });
+
+    $('.revoke_token_btn').click(function(){
+      return confirm('Are you sure to revoke this token ?'
+                     + '\nThis will break all application using it and '
+                     + 'cannot be un-done.');
+    });
+
+    $('.renew_token_btn').click(function(){
+      return confirm('Are you sure to renew this token ?'
+                     + '\nIt will have the same ACL but will be a different key.');
+    });
+
 });
 </script>
 
@@ -1485,9 +1522,9 @@ $('.ajaxed').click(function(e) {
     window.onhashchange = function () {
       $(window.location.hash.slice(0,-4)).tab('show');
     }
-    const anchor = window.location.hash.slice(0,-4);
-    console.log(anchor);
-    $(anchor).tab('show');
+    const _anchor = window.location.hash.slice(0,-4);
+    console.log(_anchor);
+    $(_anchor).tab('show');
     window.scrollTo(0,0);
   });
 </script>
diff --git a/pagure/templates/settings_api_keys.html b/pagure/templates/settings_api_keys.html
index ac2a394..b9e73d5 100644
--- a/pagure/templates/settings_api_keys.html
+++ b/pagure/templates/settings_api_keys.html
@@ -105,10 +105,7 @@
                 namespace=repo.namespace,
                 token_id=token.id) }}"
                 method="post" class="icon">
-                <button class="btn btn-outline-danger" type="submit"
-                    onclick="return confirm('Are you sure to revoke this token ?'
-                        + '\nThis will break all application using it and '
-                        + 'cannot be un-done.');"
+                <button class="btn btn-outline-danger revoke_token_btn" type="submit"
                     title="Revoke token">
                   <i class="fa fa-trash"></i>
                 </button>
@@ -122,9 +119,7 @@
                 namespace=repo.namespace,
                 token_id=token.id) }}"
                 method="post" class="icon">
-                <button class="btn btn-outline-primary" type="submit"
-                    onclick="return confirm('Are you sure to renew this token ?'
-                        + '\nIt will have the same ACL but will be a different key.');"
+                <button class="btn btn-outline-primary renew_token_btn" type="submit"
                     title="Renew token">
                   <i class="fa fa-refresh"></i>
                 </button>
diff --git a/pagure/templates/user_emails.html b/pagure/templates/user_emails.html
index 6989db4..595a84e 100644
--- a/pagure/templates/user_emails.html
+++ b/pagure/templates/user_emails.html
@@ -16,7 +16,7 @@
         <form action="{{ url_for('ui_ns.add_user_email') }}" method="post">
             {{ render_bootstrap_field(form.email) }}
             <input type="submit" class="btn btn-primary" value="Add">
-            <input type="button" value="Cancel" class="btn btn-secondary" onclick="history.back();">
+            <input type="button" value="Cancel" class="btn btn-secondary cancel_btn">
             {{ form.csrf_token }}
         </form>
       </div>
diff --git a/pagure/templates/user_settings.html b/pagure/templates/user_settings.html
index 5d80fff..6dda073 100644
--- a/pagure/templates/user_settings.html
+++ b/pagure/templates/user_settings.html
@@ -13,9 +13,8 @@
         action="{{ url_for('ui_ns.remove_user_email') }}">
       <input type="hidden" value="{{ email.email }}" name="email" />
       {{ form.csrf_token }}
-      <button
-        onclick="return confirm('Do you really want to remove the email: {{ email.email }}?');"
-        title="Remove email" class="btn btn btn-outline-danger">
+      <button title="Remove email" data-email="{{ email.email }}"
+        class="btn btn btn-outline-danger delete-email-btn">
         <i class="fa fa-trash fa-fw"></i>
       </button>
     </form>
@@ -28,9 +27,8 @@
       action="{{ url_for('ui_ns.set_default_email') }}" id="default_mail">
       <input type="hidden" value="{{ email.email }}" name="email" />
       {{ form.csrf_token }}
-      <a class="float-right p-r-1 btn btn-outline-warning border-0 text-secondary mr-1 pointer"
-         onclick="$(this).closest('form').submit();"
-         title="Set as default email address">
+      <a class="float-right p-r-1 btn btn-outline-warning border-0 text-secondary mr-1 pointer submit-btn"
+         data-form-id="email" title="Set as default email address">
          <span class="fa fa-star" data-toggle="tooltip"></span>
       </a>
     </form>
@@ -42,9 +40,8 @@
         action="{{ url_for('ui_ns.reconfirm_email') }}" id="reconfirm_mail">
         <input type="hidden" value="{{ email.email }}" name="email" />
         {{ form.csrf_token }}
-        <button
-          onclick="$(this).closest('form').submit();"
-          title="Resend validation email" class="btn btn btn-outline-primary">
+        <button data-form-id="reconfirm_mail"
+          title="Resend validation email" class="btn btn btn-outline-primary submit-btn">
           <span class="fa fa-retweet fa-fw"></span>
         </button>
       </form>
@@ -190,10 +187,7 @@
                             <form action="{{ url_for(
                                 'ui_ns.revoke_api_user_token', token_id=token.id) }}"
                               method="post" class="icon">
-                              <button class="btn btn-outline-danger" type="submit"
-                                  onclick="return confirm('Are you sure to revoke this token ?'
-                                      + '\nThis will break all application using it and '
-                                      + 'cannot be un-done.');"
+                              <button class="btn btn-outline-danger remote-token-btn" type="submit"
                                   title="Revoke token">
                                 <i class="fa fa-trash"></i>
                               </button>
@@ -232,9 +226,8 @@
                         action="{{ url_for(
                             'ui_ns.remove_user_sshkey',
                             keyid=key.id) }}">
-                        <button
-                          onclick="return confirm('You sure you want to remove this SSH key?');"
-                          title="Remove SSH key" class="btn btn-outline-danger">
+                        <button title="Remove SSH key"
+                          class="btn btn-outline-danger delete-sshkey-btn">
                           <i class="fa fa-trash"></i>
                         </button>
                         {{ form.csrf_token }}
@@ -337,6 +330,22 @@
 {{ super() }}
 <script type="text/javascript" nonce="{{ g.nonce }}">
   $(document).ready(function() {
+    $('.submit-btn').click(function() {
+      var _form_name = $(this).attr('data-form-id');
+        $('#' + _form-id).submit();
+    });
+    $('.remove-token-btn').click(function() {
+      return confirm('Are you sure to revoke this token ?'
+                     + '\nThis will break all application using it and '
+                     + 'cannot be un-done.');
+    })
+    $('.delete-email-btn').click(function() {
+      return confirm('Do you really want to remove the email: ' + $(this).attr('data-email') + '?');
+    })
+    $('.delete-sshkey-btn').click(function() {
+      return confirm('You sure you want to remove this SSH key?');
+    })
+
     $('#nav-tab a.nav-link').on('shown.bs.tab', function (e) {
       window.location.hash = e.target.hash+'-tab';
       window.scrollTo(0,0);
@@ -349,9 +358,9 @@
     window.onhashchange = function () {
       $(window.location.hash).tab('show');
     }
-    const anchor = window.location.hash;
-    console.log(anchor);
-    $(anchor).tab('show');
+    const _anchor = window.location.hash;
+    console.log(_anchor);
+    $(_anchor).tab('show');
     window.scrollTo(0,0);
 
     $(".ssh_key_btn").click(function() {
diff --git a/tests/test_pagure_flask_ui_repo_view_file.py b/tests/test_pagure_flask_ui_repo_view_file.py
index c16ac95..0c37d60 100644
--- a/tests/test_pagure_flask_ui_repo_view_file.py
+++ b/tests/test_pagure_flask_ui_repo_view_file.py
@@ -243,8 +243,8 @@ class PagureFlaskRepoViewFiletests(LocalBasetests):
             output_text,
         )
         self.assertIn(
-            'onclick="fork_project.submit();">\n                    '
-            "        Fork and Edit",
+            '<button class="btn btn-sm btn-secondary fork_project_btn">'
+                '\n                            Fork and Edit',
             output_text,
         )
 
@@ -266,8 +266,8 @@ class PagureFlaskRepoViewFiletests(LocalBasetests):
                 output_text,
             )
             self.assertIn(
-                'onclick="fork_project.submit();">\n                    '
-                "        Fork and Edit",
+                '<button class="btn btn-sm btn-secondary fork_project_btn">'
+                '\n                            Fork and Edit',
                 output_text,
             )
 
@@ -359,8 +359,8 @@ class PagureFlaskRepoViewFileForktests(LocalBasetests):
             output_text,
         )
         self.assertIn(
-            'onclick="fork_project.submit();">\n                    '
-            "        Fork and Edit",
+            '<button class="btn btn-sm btn-secondary fork_project_btn">'
+                '\n                            Fork and Edit',
             output_text,
         )
 
@@ -381,8 +381,8 @@ class PagureFlaskRepoViewFileForktests(LocalBasetests):
                 output_text,
             )
             self.assertNotIn(
-                'onclick="fork_project.submit();">\n                    '
-                "        Fork and Edit",
+                '<button class="btn btn-sm btn-secondary fork_project_btn">'
+                '\n                            Fork and Edit',
                 output_text,
             )
 
@@ -405,8 +405,8 @@ class PagureFlaskRepoViewFileForktests(LocalBasetests):
                 output_text,
             )
             self.assertIn(
-                'onclick="fork_project.submit();">\n                    '
-                "        Fork and Edit",
+                '<button class="btn btn-sm btn-secondary fork_project_btn">'
+                '\n                            Fork and Edit',
                 output_text,
             )
 
@@ -428,8 +428,8 @@ class PagureFlaskRepoViewFileForktests(LocalBasetests):
                 output_text,
             )
             self.assertIn(
-                'onclick="fork_project.submit();">\n                    '
-                "        Edit in your fork",
+                '<button class="btn btn-sm btn-secondary fork_project_btn">'
+                '\n                            Edit in your fork',
                 output_text,
             )
 

From ff53f259b1e48d21715dab9ce62a42adceaaa312 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 20 2019 13:20:25 +0000
Subject: [PATCH 5/5] Catch ImportError before trying to catch any fedora_messaging exceptions


Otherwise, if you have fedora-messaging enabled but not installed (weird
situation to be in, granted) pagure will crash instead of just notifying
you.

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/lib/notify.py b/pagure/lib/notify.py
index 3c66d08..079e719 100644
--- a/pagure/lib/notify.py
+++ b/pagure/lib/notify.py
@@ -83,6 +83,8 @@ def fedora_messaging_publish(topic, message):  # pragma: no cover
             topic="pagure.{}".format(topic), body=message
         )
         fedora_messaging.api.publish(msg)
+    except ImportError:
+        _log.warning("Fedora messaging does not appear to be available")
     except fedora_messaging.exceptions.PublishReturned as e:
         _log.warning(
             "Fedora Messaging broker rejected message %s: %s", msg.id, e