Safer way to changing user roles

app.py

@@ -24,7 +24,6 @@
 from routes.verifyUser import verifyUserBlueprint
 from routes.adminPanel import adminPanelBlueprint
 from routes.createPost import createPostBlueprint
-from routes.setUserRole import setUserRoleBlueprint
 from routes.passwordReset import passwordResetBlueprint
 from routes.changeUserName import changeUserNameBlueprint
 from routes.changePassword import changePasswordBlueprint
@@ -180,7 +179,6 @@ def csrfError(e):
 app.register_blueprint(adminPanelBlueprint)
 app.register_blueprint(createPostBlueprint)
 app.register_blueprint(verifyUserBlueprint)
-app.register_blueprint(setUserRoleBlueprint)
 app.register_blueprint(passwordResetBlueprint)
 app.register_blueprint(changeUserNameBlueprint)
 app.register_blueprint(changePasswordBlueprint)

helpers.py

@@ -134,3 +134,31 @@ def getProfilePicture(userName):
         [(userName.lower())],
     )
     return cursor.fetchone()[0]
+
+
+def changeUserRole(userName):
+    userName = userName.lower()
+    connection = sqlite3.connect(DB_USERS_ROOT)
+    cursor = connection.cursor()
+    cursor.execute(
+        """select role from users where lower(userName) = ? """,
+        [(userName)],
+    )
+    role = cursor.fetchone()[0]
+    match role:
+        case "admin":
+            newRole = "user"
+        case "user":
+            newRole = "admin"
+    cursor.execute(
+        """update users set role = ? where lower(userName) = ? """,
+        [(newRole), (userName)],
+    )
+    message(
+        "2",
+        f'ADMIN: "{session["userName"]}" CHANGED USER: "{userName}"s ROLE TO "{newRole}" ',
+    )
+    connection.commit()
+    match session["userName"].lower() == userName:
+        case True:
+            return redirect("/")

routes/adminPanelUsers.py

@@ -5,6 +5,7 @@
     redirect,
     Blueprint,
     DB_USERS_ROOT,
+    changeUserRole,
     render_template,
 )
 from delete import deleteUser
@@ -29,6 +30,9 @@ def adminPanelUsers():
                     match "userDeleteButton" in request.form:
                         case True:
                             deleteUser(request.form["userName"])
+                    match "userRoleChangeButton" in request.form:
+                        case True:
+                            changeUserRole(request.form["userName"])
             match role == "admin":
                 case True:
                     connection = sqlite3.connect(DB_USERS_ROOT)

templates/standardUI/adminPanelUsers.html

@@ -40,15 +40,18 @@ <h1 class="textCenter">Users</h1>
           delete user
         </button>
       </form>
-      {% if user[5] == "admin" %}
-      <a href="/setuserrole/{{user[1].lower()}}/user" class="textPrimary"
-        >set user role to user</a
-      >
-      {% else %}
-      <a href="/setuserrole/{{user[1].lower()}}/admin" class="textPrimary"
-        >set user role to admin</a
-      >
-      {% endif %}
+      <form method="post">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
+        <input type="hidden" name="userName" value="{{user[1]}}" />
+        <button
+          type="submit"
+          name="userRoleChangeButton"
+          class="textPrimary deleteUserButton"
+        >
+          {% if user[5] == "admin" %} set user role to user {% else %} set user
+          role to admin {% endif %}
+        </button>
+      </form>
     </section>
   </div>
   {% endfor %}

templates/tailwindUI/adminPanelUsers.html

@@ -59,19 +59,20 @@ <h1 class="my-4 text-4xl font-medium select-none">Users</h1>
           delete user
         </button>
       </form>
-      {% if user[5] == "admin" %}
-      <a
-        href="/setuserrole/{{user[1].lower()}}/user"
-        class="flex items-center hover:text-rose-500 duration-150 font-medium select-none"
-        ><i class="ti ti-user-down mr-1 text-xl"></i> set user role to user</a
-      >
-      {% else %}
-      <a
-        href="/setuserrole/{{user[1].lower()}}/admin"
-        class="flex items-center hover:text-rose-500 duration-150 font-medium select-none"
-        ><i class="ti ti-user-up mr-1 text-xl"></i>set user role to admin</a
-      >
-      {% endif %}
+      <form method="post">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
+        <input type="hidden" name="userName" value="{{user[1]}}" />
+        <button
+          type="submit"
+          name="userRoleChangeButton"
+          class="flex items-center hover:text-rose-500 duration-150 font-medium select-none"
+        >
+          {% if user[5] == "admin" %}
+          <i class="ti ti-user-down mr-1 text-xl"></i> set user role to user {%
+          else %} <i class="ti ti-user-up mr-1 text-xl"></i> set user role to
+          admin {% endif %}
+        </button>
+      </form>
     </section>
   </div>
   {% endfor %}