From 7479a6c4ea0fe340240f433a25f3a11f30f880f1 Mon Sep 17 00:00:00 2001
From: Beverly Nguyen <Beverly.Nguyen@gsa.gov>
Date: Fri, 8 Mar 2024 15:05:44 -0800
Subject: [PATCH] made changes to the token and removed extra handling errors

---
 app/main/views/send.py                       | 26 ++++----------------
 app/templates/views/check/ok.html            |  3 ++-
 app/templates/views/notifications/check.html |  3 ++-
 3 files changed, 9 insertions(+), 23 deletions(-)

diff --git a/app/main/views/send.py b/app/main/views/send.py
index d2793e48f..731c598e6 100644
--- a/app/main/views/send.py
+++ b/app/main/views/send.py
@@ -634,32 +634,16 @@ def check_messages(service_id, template_id, upload_id, row_index=2):
 
 @main.route(
     "/services/<uuid:service_id>/<uuid:template_id>/check/<uuid:upload_id>/preview",
-    methods=["GET"],
+    methods=["POST"],
 )
 @main.route(
     "/services/<uuid:service_id>/<uuid:template_id>/check/<uuid:upload_id>/preview/row-<int:row_index>",
-    methods=["GET"],
+    methods=["POST"],
 )
 @user_has_permissions("send_messages", restrict_admin_usage=True)
 def preview_job(service_id, template_id, upload_id, row_index=2):
-    session["scheduled_for"] = request.args.get("scheduled_for", "")
+    session["scheduled_for"] = request.form.get("scheduled_for", "")
     data = _check_messages(service_id, template_id, upload_id, row_index)
-    data["allowed_file_extensions"] = Spreadsheet.ALLOWED_FILE_EXTENSIONS
-    if (
-        data["recipients"].too_many_rows
-        or not data["count_of_recipients"]
-        or not data["recipients"].has_recipient_columns
-        or data["recipients"].duplicate_recipient_column_headers
-        or data["recipients"].missing_column_headers
-        or data["sent_previously"]
-    ):
-        return render_template("views/check/column-errors.html", **data)
-
-    if data["row_errors"]:
-        return render_template("views/check/row-errors.html", **data)
-
-    if data["errors"]:
-        return render_template("views/check/column-errors.html", **data)
 
     return render_template(
         "views/check/preview.html",
@@ -907,7 +891,7 @@ def get_template_error_dict(exception):
 
 @main.route(
     "/services/<uuid:service_id>/template/<uuid:template_id>/notification/check/preview",
-    methods=["GET"],
+    methods=["POST"],
 )
 @user_has_permissions("send_messages", restrict_admin_usage=True)
 def preview_notification(service_id, template_id):
@@ -921,7 +905,7 @@ def preview_notification(service_id, template_id):
             )
         )
 
-    session["scheduled_for"] = request.args.get("scheduled_for", "")
+    session["scheduled_for"] = request.form.get("scheduled_for", "")
 
     return render_template(
         "views/notifications/preview.html",
diff --git a/app/templates/views/check/ok.html b/app/templates/views/check/ok.html
index 6a925c7d1..015cb1ee1 100644
--- a/app/templates/views/check/ok.html
+++ b/app/templates/views/check/ok.html
@@ -22,7 +22,8 @@
 
   {{ template|string }}
   <div class="bottom-gutter-3-2">
-    <form method="get" enctype="multipart/form-data" action="{{url_for('main.preview_job', service_id=current_service.id, template_id=template_id, upload_id=upload_id)}}" class='page-footer'>
+    <form method="post" enctype="multipart/form-data" action="{{url_for('main.preview_job', service_id=current_service.id, template_id=template_id, upload_id=upload_id)}}" class='page-footer'>
+      <input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
       {% if choose_time_form %}
         {{ choose_time_form.scheduled_for(param_extensions={
           'formGroup': {'classes': 'bottom-gutter-2-3'},
diff --git a/app/templates/views/notifications/check.html b/app/templates/views/notifications/check.html
index 86f704495..8646d1b7f 100644
--- a/app/templates/views/notifications/check.html
+++ b/app/templates/views/notifications/check.html
@@ -46,11 +46,12 @@
   {{ template|string }}
 
   <div class="js-stick-at-bottom-when-scrolling">
-    <form method="get" enctype="multipart/form-data" action="{{url_for(
+    <form method="post" enctype="multipart/form-data" action="{{url_for(
         'main.preview_notification',
         service_id=current_service.id,
         template_id=template.id
       )}}" class='page-footer'>
+      <input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
       {% if not error %}
         {% if choose_time_form %}
           {{ choose_time_form.scheduled_for(param_extensions={