Safer button template rendering

app.py

@@ -238,7 +238,7 @@ def mark_read(notification_id):

                                
                                
                                
                            
                                
                                    
                                        
                                            238  
                                                    flask.abort(403)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            239  
                                                notification.mark_read()
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            240  
                                                db.session.commit()
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        241 -
                                            return f"<button hx-post='/notifications/{ notification.id }/unread' hx-swap='outerHTML'>Mark as unread</button>", 200
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        241 +
                                            return flask.render_template_string("<button hx-post='/notifications/{{ notification.id }}/unread' hx-swap='outerHTML'>Mark as unread</button>", notification=notification), 200
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            242  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            243  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            244  
                                            @app.route("/notifications/<int:notification_id>/unread", methods=["POST"])
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -250,7 +250,7 @@ def mark_unread(notification_id):

                                
                                
                                
                            
                                
                                    
                                        
                                            250  
                                                    flask.abort(403)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            251  
                                                notification.mark_unread()
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            252  
                                                db.session.commit()
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        253 -
                                            return f"<button hx-post='/notifications/{ notification.id }/read' hx-swap='outerHTML'>Mark as read</button>", 200
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        253 +
                                            return flask.render_template_string("<button hx-post='/notifications/{{ notification.id }}/read' hx-swap='outerHTML'>Mark as read</button>", notification=notification), 200
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            254  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            255  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            256  
                                            @app.route("/notifications/mark-all-read", methods=["POST"])