From 5e40388afb1867391aaac03c3cd8b3d26e280177 Mon Sep 17 00:00:00 2001
From: Simon Leary <simon.leary42@proton.me>
Date: Tue, 14 Oct 2025 11:21:02 -0400
Subject: [PATCH 1/2] disable button to prevent double submit

---
 resources/templates/header.php           |  6 +-
 webroot/admin/ajax/get_group_members.php | 18 +++++-
 webroot/admin/pi-mgmt.php                | 13 +++-
 webroot/panel/account.php                | 78 +++++++++++++++++++-----
 webroot/panel/groups.php                 | 10 ++-
 webroot/panel/modal/new_key.php          | 22 ++++++-
 webroot/panel/modal/new_pi.php           |  2 +-
 webroot/panel/new_account.php            | 15 ++++-
 webroot/panel/pi.php                     | 16 ++++-
 9 files changed, 147 insertions(+), 33 deletions(-)

diff --git a/resources/templates/header.php b/resources/templates/header.php
index 23435428..62dfcbd9 100644
--- a/resources/templates/header.php
+++ b/resources/templates/header.php
@@ -162,7 +162,11 @@
             <form method='POST' action=''>
               <input type='hidden' name='form_type' value='clearView'>
               <input type='hidden' name='uid' value='$viewUser'>
-              <input type='submit' value='Return to My User'>
+              <input
+                type='submit'
+                value='Return to My User'
+                onclick='this.form.submit(); this.disabled=true;'
+              />
             </form>
           </div>
         ";
diff --git a/webroot/admin/ajax/get_group_members.php b/webroot/admin/ajax/get_group_members.php
index cebf4115..cd9bcdcb 100644
--- a/webroot/admin/ajax/get_group_members.php
+++ b/webroot/admin/ajax/get_group_members.php
@@ -45,7 +45,7 @@
         <input type='hidden' name='form_type' value='remUserChild'>
         <input type='hidden' name='uid' value='" . $member->uid . "'>
         <input type='hidden' name='pi' value='" . $group->gid . "'>
-        <input type='submit' value='Remove'>
+        <input type='submit' value='Remove' onclick='this.form.submit(); this.disabled=true;'>
         </form>
     ";
     echo "</td>";
@@ -71,8 +71,20 @@
     <input type='hidden' name='form_type' value='reqChild'>
     <input type='hidden' name='uid' value='" . $uid . "'>
     <input type='hidden' name='pi' value='" . $group->gid . "'>
-    <input type='submit' name='action' value='Approve'>
-    <input type='submit' name='action' value='Deny'></form>";
+    <input
+      type='submit'
+      name='action'
+      value='Approve'
+      onclick='this.form.submit(); this.disabled=true;'
+    />
+    <input
+      type='submit'
+      name='action'
+      value='Deny'
+      onclick='this.form.submit(); this.disabled=true;'
+    />
+    </form>
+    ";
     echo "</td>";
     echo "</tr>";
 
diff --git a/webroot/admin/pi-mgmt.php b/webroot/admin/pi-mgmt.php
index dc247326..0e582808 100644
--- a/webroot/admin/pi-mgmt.php
+++ b/webroot/admin/pi-mgmt.php
@@ -65,6 +65,7 @@
     $requests = $SQL->getRequests();
 
     foreach ($requests as $request) {
+        $uid = $request["uid"];
         echo "<tr>";
         echo "<td>" . $request["firstname"] . " " . $request["lastname"] . "</td>";
         echo "<td>" . $request["uid"] . "</td>";
@@ -76,9 +77,17 @@
         <input type='hidden' name='form_type' value='req'>
         <input type='hidden' name='uid' value='" . $request["uid"] . "'>
         <input type='submit' name='action' value='Approve'
-        onclick='return confirm(\"Are you sure you want to approve " . $request["uid"] . "?\");'>
+        onclick='
+          confirm(\"Are you sure you want to approve $uid?\")
+          && this.form.submit()
+          && this.disabled=true;
+        '>
         <input type='submit' name='action' value='Deny'
-        onclick='return confirm(\"Are you sure you want to deny " . $request["uid"] . "?\");'>
+        onclick='
+          confirm(\"Are you sure you want to deny $uid?\")
+          && this.form.submit()
+          && this.disabled=true;
+        '>
         </form>";
         echo "</td>";
         echo "</tr>";
diff --git a/webroot/panel/account.php b/webroot/panel/account.php
index add0e67e..3485068e 100644
--- a/webroot/panel/account.php
+++ b/webroot/panel/account.php
@@ -156,7 +156,14 @@
         >
     ";
     if ($SQL->accDeletionRequestExists($USER->uid)) {
-        echo "<input type='submit' value='Request PI Account' disabled />";
+        echo "
+          <input
+            type='submit'
+            value='Request PI Account'
+            onclick='this.form.submit(); this.disabled=true;'
+            disabled
+          />
+        ";
         echo "
             <label style='margin-left: 10px'>
                 You cannot request PI Account while you have requested account deletion.
@@ -164,8 +171,17 @@
         ";
     } else {
         if ($SQL->requestExists($USER->uid)) {
-            $prompt = "onclick='return confirm(\"Are you sure you want to cancel this request?\")";
-            echo "<input type='submit' value='Cancel PI Account Request' $prompt'/>";
+            echo "
+              <input
+                type='submit'
+                value='Cancel PI Account Request'
+                onclick='
+                  confirm(\"Are you sure you want to cancel this request?\")
+                  && this.form.submit()
+                  && this.disabled=true;
+                '
+              />
+            ";
             echo "
                 <label style='margin-left: 10px'>
                     Your request has been submitted and is currently pending
@@ -174,8 +190,17 @@
             ";
         } else {
             echo "<input type='hidden' name='form_type' value='pi_request'/>";
-            $prompt = "onclick='return confirm(\"Are you sure you want to request a PI account?\")";
-            echo "<input type='submit' value='Request PI Account' $prompt'/>";
+            echo "
+              <input
+                type='submit'
+                value='Request PI Account'
+                onclick='
+                  confirm(\"Are you sure you want to request a PI account?\")
+                  && this.form.submit()
+                  && this.disabled=true;
+                '
+              />
+            ";
         }
     }
     echo "</form>";
@@ -199,7 +224,11 @@
         >
             <input type='hidden' name='delIndex' value='$i' />
             <input type='hidden' name='form_type' value='delKey' />
-            <input type='submit' value='&times;' />
+            <input
+              type='submit'
+              value='&times;'
+              onclick='this.form.submit(); this.disabled=true;'
+            />
         </form>
     </div>";
 }
@@ -216,12 +245,17 @@
     echo "<option>$shell</option>";
 }
 echo "
-    </select>
-    <br>
-    <input id='submitLoginShell' type='submit' value='Set Login Shell' />
-    </form>
-    <hr>
-    <h5>Account Deletion</h5>
+  </select>
+  <br>
+  <input
+    type='submit'
+    id='submitLoginShell'
+    value='Set Login Shell'
+    onclick='this.form.submit(); this.disabled=true;'
+  />
+  </form>
+  <hr>
+  <h5>Account Deletion</h5>
 ";
 
 if ($hasGroups) {
@@ -237,13 +271,25 @@
         <input type='hidden' name='form_type' value='account_deletion_request' />
     ";
     if ($SQL->accDeletionRequestExists($USER->uid)) {
-        echo "<input type='submit' value='Request Account Deletion' disabled />";
         echo "
-            <label style='margin-left: 10px'>
-            Your request has been submitted and is currently pending</label>
+          <input
+            type='submit'
+            value='Request Account Deletion'
+            onclick='this.form.submit(); this.disabled=true;'
+            disabled
+          />
+          <label style='margin-left: 10px'>
+            Your request has been submitted and is currently pending
+          </label>
         ";
     } else {
-        echo "<input type='submit' value='Request Account Deletion' />";
+        echo "
+          <input
+            type='submit'
+            value='Request Account Deletion'
+            onclick='this.form.submit(); this.disabled=true;'
+          >
+        ";
     }
     echo "</form>";
 }
diff --git a/webroot/panel/groups.php b/webroot/panel/groups.php
index 18b210c8..f28d4b58 100644
--- a/webroot/panel/groups.php
+++ b/webroot/panel/groups.php
@@ -95,7 +95,13 @@
         echo "<form action='' method='POST' id='cancelPI'>
             <input type='hidden' name='pi' value='{$requested_account->gid}'>
             <input type='hidden' name='form_type' value='cancelPIForm'>
-            <input name='cancel' style='margin-top: 10px;' type='submit' value='Cancel Request'/>
+            <input
+              name='cancel'
+              style='margin-top: 10px;'
+              type='submit'
+              value='Cancel Request'
+              onclick='this.form.submit(); this.disabled=true;'
+            />
             </form>";
         echo "</td>";
         echo "</tr>";
@@ -144,7 +150,7 @@
     onsubmit='return confirm(\"Are you sure you want to leave the PI group " . $group->gid . "?\")'>
     <input type='hidden' name='form_type' value='removePIForm'>
     <input type='hidden' name='pi' value='" . $group->gid . "'>
-    <input type='submit' value='Leave Group'>
+    <input type='submit' value='Leave Group' onclick='this.form.submit(); this.disabled=true;'>
     </form>
     </td>";
     echo "</tr>";
diff --git a/webroot/panel/modal/new_key.php b/webroot/panel/modal/new_key.php
index 55d0df12..25ab0491 100644
--- a/webroot/panel/modal/new_key.php
+++ b/webroot/panel/modal/new_key.php
@@ -31,13 +31,24 @@
 
     <div id="key_paste">
         <textarea placeholder="ssh-rsa AAARs1..." form="newKeyform" name="key"></textarea>
-        <input type="submit" value="Add Key" id="add-key" disabled />
+        <input
+          type="submit"
+          value="Add Key"
+          id="add-key"
+          onclick="this.form.submit(); this.disabled=true;"
+          disabled
+        />
     </div>
 
     <div style="display: none;" id="key_import">
         <label for="keyfile">Select local file:</label>
         <input type="file" name="keyfile" />
-        <input type="submit" value="Import Key" disabled />
+        <input
+          type="submit"
+          value="Import Key"
+          onclick="this.form.submit(); this.disabled=true;"
+          disabled
+        />
     </div>
 
     <div style="display: none;" id="key_generate">
@@ -49,7 +60,12 @@
     <div style="display: none;" id="key_github">
         <div class='inline'>
             <input type="text" name="gh_user" placeholder="GitHub Username" />
-            <input type="submit" value="Import Key(s)" disabled />
+            <input
+              type="submit"
+              value="Import Key(s)"
+              onclick="this.form.submit(); this.disabled=true;"
+              disabled
+            />
         </div>
     </div>
 </form>
diff --git a/webroot/panel/modal/new_pi.php b/webroot/panel/modal/new_pi.php
index 53368e96..efa64ba2 100644
--- a/webroot/panel/modal/new_pi.php
+++ b/webroot/panel/modal/new_pi.php
@@ -13,7 +13,7 @@
         <input type="text" id="pi_search" name="pi" placeholder="Search PI by NetID" required>
         <div class="searchWrapper" style="display: none;"></div>
     </div>
-    <input type="submit" value="Send Request">
+    <input type="submit" value="Send Request" onclick="this.form.submit(); this.disabled=true;">
 </form>
 
 <script>
diff --git a/webroot/panel/new_account.php b/webroot/panel/new_account.php
index 34863657..c4d5f5e4 100644
--- a/webroot/panel/new_account.php
+++ b/webroot/panel/new_account.php
@@ -103,7 +103,13 @@
         <p>You may need to remind them.</p>
         <hr>
         <form action="" method="POST">
-            <input name="cancel" style='margin-top: 10px;' type='submit' value='Cancel Request'/>
+          <input
+            name="cancel"
+            style='margin-top: 10px;'
+            type='submit'
+            value='Cancel Request'
+            onclick='this.form.submit(); this.disabled=true;'
+          />
         </form>
     <?php endforeach; ?>
 <?php else : ?>
@@ -149,7 +155,12 @@
             </a>.
         </label>
         <br>
-        <input style='margin-top: 10px;' type='submit' value='Request Account'>
+        <input
+          style='margin-top: 10px;'
+          type='submit'
+          value='Request Account'
+          onclick='this.form.submit(); this.disabled=true;'
+        />
     </form>
 <?php endif; ?>
 
diff --git a/webroot/panel/pi.php b/webroot/panel/pi.php
index 08531a0c..4612f338 100644
--- a/webroot/panel/pi.php
+++ b/webroot/panel/pi.php
@@ -67,9 +67,17 @@
         <input type='hidden' name='form_type' value='userReq'>
         <input type='hidden' name='uid' value='" . $uid . "'>
         <input type='submit' name='action' value='Approve'
-        onclick='return confirm(\"Are you sure you want to approve " . $uid . "?\")'>
+        onclick='
+          confirm(\"Are you sure you want to approve $uid?\")
+          && this.form.submit()
+          && this.disabled=true;
+        '>
         <input type='submit' name='action' value='Deny'
-        onclick='return confirm(\"Are you sure you want to deny " . $uid . "?\")'>
+        onclick='
+          confirm(\"Are you sure you want to deny $uid?\")
+          && this.form.submit()
+          && this.disabled=true;
+        '>
         </form>";
         echo "</td>";
         echo "</tr>";
@@ -100,7 +108,9 @@
         type='submit'
         value='Remove'
         onclick='
-            return confirm(\"Are you sure you want to remove $assoc->uid from your PI group?\")
+          confirm(\"Are you sure you want to remove $assoc->uid from your PI group?\")
+          && this.form.submit()
+          && this.disabled=true;
         '
     >
     </form>";

From 510e8068a212e4e71f8e141ef0b9130b175170ae Mon Sep 17 00:00:00 2001
From: Simon Leary <simon.leary42@proton.me>
Date: Tue, 14 Oct 2025 11:30:20 -0400
Subject: [PATCH 2/2] condense

---
 resources/templates/header.php           |  3 +--
 webroot/admin/ajax/get_group_members.php |  8 ++----
 webroot/admin/pi-mgmt.php                | 28 ++++++++++++---------
 webroot/panel/account.php                | 22 ++++++-----------
 webroot/panel/groups.php                 |  5 +---
 webroot/panel/modal/new_key.php          | 13 +++-------
 webroot/panel/new_account.php            |  9 ++-----
 webroot/panel/pi.php                     | 31 +++++++++++++-----------
 8 files changed, 49 insertions(+), 70 deletions(-)

diff --git a/resources/templates/header.php b/resources/templates/header.php
index 62dfcbd9..1687022e 100644
--- a/resources/templates/header.php
+++ b/resources/templates/header.php
@@ -163,8 +163,7 @@
               <input type='hidden' name='form_type' value='clearView'>
               <input type='hidden' name='uid' value='$viewUser'>
               <input
-                type='submit'
-                value='Return to My User'
+                type='submit' value='Return to My User'
                 onclick='this.form.submit(); this.disabled=true;'
               />
             </form>
diff --git a/webroot/admin/ajax/get_group_members.php b/webroot/admin/ajax/get_group_members.php
index cd9bcdcb..ac915c42 100644
--- a/webroot/admin/ajax/get_group_members.php
+++ b/webroot/admin/ajax/get_group_members.php
@@ -72,15 +72,11 @@
     <input type='hidden' name='uid' value='" . $uid . "'>
     <input type='hidden' name='pi' value='" . $group->gid . "'>
     <input
-      type='submit'
-      name='action'
-      value='Approve'
+      type='submit' name='action' value='Approve'
       onclick='this.form.submit(); this.disabled=true;'
     />
     <input
-      type='submit'
-      name='action'
-      value='Deny'
+      type='submit' name='action' value='Deny'
       onclick='this.form.submit(); this.disabled=true;'
     />
     </form>
diff --git a/webroot/admin/pi-mgmt.php b/webroot/admin/pi-mgmt.php
index 0e582808..dc3dffce 100644
--- a/webroot/admin/pi-mgmt.php
+++ b/webroot/admin/pi-mgmt.php
@@ -76,18 +76,22 @@
             "<form action='' method='POST'>
         <input type='hidden' name='form_type' value='req'>
         <input type='hidden' name='uid' value='" . $request["uid"] . "'>
-        <input type='submit' name='action' value='Approve'
-        onclick='
-          confirm(\"Are you sure you want to approve $uid?\")
-          && this.form.submit()
-          && this.disabled=true;
-        '>
-        <input type='submit' name='action' value='Deny'
-        onclick='
-          confirm(\"Are you sure you want to deny $uid?\")
-          && this.form.submit()
-          && this.disabled=true;
-        '>
+        <input
+          type='submit' name='action' value='Approve'
+          onclick='
+            confirm(\"Are you sure you want to approve $uid?\")
+            && this.form.submit()
+            && this.disabled=true;
+          '
+        >
+        <input
+          type='submit' name='action' value='Deny'
+          onclick='
+            confirm(\"Are you sure you want to deny $uid?\")
+            && this.form.submit()
+            && this.disabled=true;
+          '
+        >
         </form>";
         echo "</td>";
         echo "</tr>";
diff --git a/webroot/panel/account.php b/webroot/panel/account.php
index 3485068e..24c1d21e 100644
--- a/webroot/panel/account.php
+++ b/webroot/panel/account.php
@@ -158,10 +158,8 @@
     if ($SQL->accDeletionRequestExists($USER->uid)) {
         echo "
           <input
-            type='submit'
-            value='Request PI Account'
+            type='submit' value='Request PI Account' disabled
             onclick='this.form.submit(); this.disabled=true;'
-            disabled
           />
         ";
         echo "
@@ -173,8 +171,7 @@
         if ($SQL->requestExists($USER->uid)) {
             echo "
               <input
-                type='submit'
-                value='Cancel PI Account Request'
+                type='submit' value='Cancel PI Account Request'
                 onclick='
                   confirm(\"Are you sure you want to cancel this request?\")
                   && this.form.submit()
@@ -192,8 +189,7 @@
             echo "<input type='hidden' name='form_type' value='pi_request'/>";
             echo "
               <input
-                type='submit'
-                value='Request PI Account'
+                type='submit' value='Request PI Account'
                 onclick='
                   confirm(\"Are you sure you want to request a PI account?\")
                   && this.form.submit()
@@ -225,8 +221,7 @@
             <input type='hidden' name='delIndex' value='$i' />
             <input type='hidden' name='form_type' value='delKey' />
             <input
-              type='submit'
-              value='&times;'
+              type='submit' value='&times;'
               onclick='this.form.submit(); this.disabled=true;'
             />
         </form>
@@ -249,8 +244,7 @@
   <br>
   <input
     type='submit'
-    id='submitLoginShell'
-    value='Set Login Shell'
+    id='submitLoginShell' value='Set Login Shell'
     onclick='this.form.submit(); this.disabled=true;'
   />
   </form>
@@ -273,8 +267,7 @@
     if ($SQL->accDeletionRequestExists($USER->uid)) {
         echo "
           <input
-            type='submit'
-            value='Request Account Deletion'
+            type='submit' value='Request Account Deletion'
             onclick='this.form.submit(); this.disabled=true;'
             disabled
           />
@@ -285,8 +278,7 @@
     } else {
         echo "
           <input
-            type='submit'
-            value='Request Account Deletion'
+            type='submit' value='Request Account Deletion'
             onclick='this.form.submit(); this.disabled=true;'
           >
         ";
diff --git a/webroot/panel/groups.php b/webroot/panel/groups.php
index f28d4b58..8dda1052 100644
--- a/webroot/panel/groups.php
+++ b/webroot/panel/groups.php
@@ -96,10 +96,7 @@
             <input type='hidden' name='pi' value='{$requested_account->gid}'>
             <input type='hidden' name='form_type' value='cancelPIForm'>
             <input
-              name='cancel'
-              style='margin-top: 10px;'
-              type='submit'
-              value='Cancel Request'
+              name='cancel' style='margin-top: 10px;' type='submit' value='Cancel Request'
               onclick='this.form.submit(); this.disabled=true;'
             />
             </form>";
diff --git a/webroot/panel/modal/new_key.php b/webroot/panel/modal/new_key.php
index 25ab0491..24d74259 100644
--- a/webroot/panel/modal/new_key.php
+++ b/webroot/panel/modal/new_key.php
@@ -32,11 +32,8 @@
     <div id="key_paste">
         <textarea placeholder="ssh-rsa AAARs1..." form="newKeyform" name="key"></textarea>
         <input
-          type="submit"
-          value="Add Key"
-          id="add-key"
+          type="submit" value="Add Key" id="add-key" disabled
           onclick="this.form.submit(); this.disabled=true;"
-          disabled
         />
     </div>
 
@@ -44,10 +41,8 @@
         <label for="keyfile">Select local file:</label>
         <input type="file" name="keyfile" />
         <input
-          type="submit"
-          value="Import Key"
+          type="submit" value="Import Key" disabled
           onclick="this.form.submit(); this.disabled=true;"
-          disabled
         />
     </div>
 
@@ -61,10 +56,8 @@
         <div class='inline'>
             <input type="text" name="gh_user" placeholder="GitHub Username" />
             <input
-              type="submit"
-              value="Import Key(s)"
+              type="submit" value="Import Key(s)" disabled
               onclick="this.form.submit(); this.disabled=true;"
-              disabled
             />
         </div>
     </div>
diff --git a/webroot/panel/new_account.php b/webroot/panel/new_account.php
index c4d5f5e4..bfbba077 100644
--- a/webroot/panel/new_account.php
+++ b/webroot/panel/new_account.php
@@ -104,10 +104,7 @@
         <hr>
         <form action="" method="POST">
           <input
-            name="cancel"
-            style='margin-top: 10px;'
-            type='submit'
-            value='Cancel Request'
+            name="cancel" style='margin-top: 10px;' type='submit' value='Cancel Request'
             onclick='this.form.submit(); this.disabled=true;'
           />
         </form>
@@ -156,9 +153,7 @@
         </label>
         <br>
         <input
-          style='margin-top: 10px;'
-          type='submit'
-          value='Request Account'
+          style='margin-top: 10px;' type='submit' value='Request Account'
           onclick='this.form.submit(); this.disabled=true;'
         />
     </form>
diff --git a/webroot/panel/pi.php b/webroot/panel/pi.php
index 4612f338..7e98437b 100644
--- a/webroot/panel/pi.php
+++ b/webroot/panel/pi.php
@@ -66,18 +66,22 @@
             "<form action='' method='POST'>
         <input type='hidden' name='form_type' value='userReq'>
         <input type='hidden' name='uid' value='" . $uid . "'>
-        <input type='submit' name='action' value='Approve'
-        onclick='
-          confirm(\"Are you sure you want to approve $uid?\")
-          && this.form.submit()
-          && this.disabled=true;
-        '>
-        <input type='submit' name='action' value='Deny'
-        onclick='
-          confirm(\"Are you sure you want to deny $uid?\")
-          && this.form.submit()
-          && this.disabled=true;
-        '>
+        <input
+          type='submit' name='action' value='Approve'
+          onclick='
+            confirm(\"Are you sure you want to approve $uid?\")
+            && this.form.submit()
+            && this.disabled=true;
+          '
+        >
+        <input
+          type='submit' name='action' value='Deny'
+          onclick='
+            confirm(\"Are you sure you want to deny $uid?\")
+            && this.form.submit()
+            && this.disabled=true;
+          '
+        >
         </form>";
         echo "</td>";
         echo "</tr>";
@@ -105,8 +109,7 @@
     <input type='hidden' name='form_type' value='remUser'>
     <input type='hidden' name='uid' value='" . $assoc->uid . "'>
     <input
-        type='submit'
-        value='Remove'
+        type='submit' value='Remove'
         onclick='
           confirm(\"Are you sure you want to remove $assoc->uid from your PI group?\")
           && this.form.submit()