@@ -81,18 +81,27 @@ def upload_file():
81
81
82
82
83
83
# To change to form insead of simple get
84
- @bp .route ("/delete_image" , methods = ["GET" , " POST" ])
84
+ @bp .route ("/delete_image" , methods = ["POST" ])
85
85
@login_required
86
86
def delete_image ():
87
- """Page to delete an image record from database"""
87
+ """Page to delete an image record from database from AJAX request"""
88
+ # Get AJAX JSON data and parse it
89
+ raw_data = request .get_data ()
90
+ parsed = json .loads (raw_data )
88
91
image_requested = Image .query .filter_by (
89
- image_name = request . args . get ( "filename" ) ,
90
- patient_id = request . args . get ( "patient_ID" ) ).first ()
91
- # Check if image to delete have been created by current user
92
+ image_name = parsed [ "image_name" ] ,
93
+ patient_id = parsed [ "patient_id" ] ).first ()
94
+ # If current user is the creator of image: delete from DB
92
95
if image_requested != None and image_requested .expert_id == current_user .id :
93
96
db .session .delete (image_requested )
94
97
db .session .commit ()
95
- return redirect (url_for ('imgannot.upload_file' ))
98
+ return json .dumps ({"success" : True }), 200 , {
99
+ "ContentType" : "application/json"
100
+ }
101
+ # Error message if not the right user for given image
102
+ else :
103
+ flash ('Unautorized database manipulation (delete_image)' , "error" )
104
+ return redirect (url_for ('imgannot.upload_file' ))
96
105
97
106
98
107
@bp .route ("/annot" , methods = ["GET" , "POST" ])
0 commit comments