From bba188e481ef32c38970f870aed045c25207ac8f Mon Sep 17 00:00:00 2001
From: Lazlo Westerhof <l.r.westerhof@uu.nl>
Date: Mon, 12 Aug 2024 15:55:49 +0200
Subject: [PATCH 1/5] Fix DOM text reinterpreted as HTML

---
 .../deposit/js/dlgFileBrowseOperations.js     |  6 +++---
 deposit/templates/deposit/data.html           |  1 +
 .../static/group_manager/js/group_manager.js  | 19 +++++++++++--------
 .../templates/group_manager/index.html        |  1 +
 .../research/js/dlgFileBrowseOperations.js    |  6 +++---
 research/templates/research/browse.html       |  1 +
 search/static/search/js/revision.js           |  8 +++++---
 search/static/search/js/search.js             |  4 +++-
 search/templates/search/search.html           |  1 +
 vault/static/vault/js/dlgSelectCollection.js  |  3 ++-
 vault/templates/vault/browse.html             |  1 +
 11 files changed, 32 insertions(+), 19 deletions(-)

diff --git a/deposit/static/deposit/js/dlgFileBrowseOperations.js b/deposit/static/deposit/js/dlgFileBrowseOperations.js
index 65e10ce8..05600023 100644
--- a/deposit/static/deposit/js/dlgFileBrowseOperations.js
+++ b/deposit/static/deposit/js/dlgFileBrowseOperations.js
@@ -1,4 +1,4 @@
-/* global browse, path */
+/* global browse, DOMPurify, path */
 'use strict'
 
 let folderSelectBrowser = null
@@ -133,7 +133,7 @@ $(document).ready(function () {
                     <td class="item-progress">-</td>
                 </tr>
                 `
-        $('.multi-select-table tbody').append(row)
+        $('.multi-select-table tbody').append(DOMPurify.sanitize(row))
       })
 
       if (action === 'multiple-delete') {
@@ -694,7 +694,7 @@ function dlgMakeBreadcrumb (urlEncodedDir) {
 /// alert handling
 function dlgSelectAlertShow (errorMessage) {
   $('#dlg-select-alert-panel').removeClass('hide')
-  $('#dlg-select-alert-panel span').html(errorMessage)
+  $('#dlg-select-alert-panel span').html(DOMPurify.sanitize(errorMessage))
 }
 
 function dlgSelectAlertHide () {
diff --git a/deposit/templates/deposit/data.html b/deposit/templates/deposit/data.html
index d8d9d7d8..24e6d34e 100644
--- a/deposit/templates/deposit/data.html
+++ b/deposit/templates/deposit/data.html
@@ -13,6 +13,7 @@
     var path = {{ path|tojson|safe }};
     var view = 'browse';
 </script>
+<script src="{{ url_for('static', filename='lib/purify-3.1.6/js/purify.min.js') }}"></script>
 <script src="{{ url_for('static', filename='lib/datatables-1.13.5/datatables.min.js') }}"></script>
 <script src="{{ url_for('deposit_bp.static', filename='lib/flow-js/flow.min.js') }}"></script>
 <script src="{{ url_for('deposit_bp.static', filename='lib/dragbetter-js/jquery.dragbetter.js') }}"></script>
diff --git a/group_manager/static/group_manager/js/group_manager.js b/group_manager/static/group_manager/js/group_manager.js
index dc62b8be..e35dce37 100644
--- a/group_manager/static/group_manager/js/group_manager.js
+++ b/group_manager/static/group_manager/js/group_manager.js
@@ -1,4 +1,4 @@
-/* global bootstrap, FileReader, jQuery, Option */
+/* global bootstrap, DOMPurify, FileReader, jQuery, Option */
 'use strict'
 
 let enteredUsername = ''
@@ -973,7 +973,8 @@ $(function () {
       $('.properties-update').removeClass('hidden')
       $('.users').removeClass('hidden')
 
-      $('#group-properties-group-name').html('<strong>[' + groupName + ']</strong>')
+      const sanitizedGroupName = DOMPurify.sanitize('<strong>[' + groupName + ']</strong>')
+      $('#group-properties-group-name').html(sanitizedGroupName)
 
       $oldGroup.removeClass('active')
       $group.addClass('active')
@@ -1346,7 +1347,8 @@ $(function () {
           // $(this).val(null).trigger('change')
         }).on('change', function () {
           // Reset the subcategory value
-          $($(this).attr('data-subcategory')).val(null).trigger('change')
+          const sanitizedSubCategory = DOMPurify.sanitize($(this).attr('data-subcategory'))
+          $(sanitizedSubCategory).val(null).trigger('change')
 
           // bring over the category value to the schema-id if exists.
           if (that.schemaIDs.includes($(this).select2('data')[0].id)) {
@@ -1376,6 +1378,8 @@ $(function () {
       $(sel).filter('.selectify-subcategory').each(function () {
         const $el = $(this)
 
+        const sanitizedCategory = DOMPurify.sanitize($el.attr('data-category'))
+
         $el.select2({
           placeholder: 'Select a subcategory or enter a new name',
           ajax: {
@@ -1386,7 +1390,7 @@ $(function () {
             data: function (params) {
               const request = {
                 query: '',
-                category: $($el.attr('data-category')).val()
+                category: $(sanitizedCategory).val()
               }
               if (params.term) {
                 request.query = params.term
@@ -1544,7 +1548,8 @@ $(function () {
 
               users.forEach(function (userName) {
                 // Exclude users already in the group.
-                if (!(userName in that.groups[$($el.attr('data-group')).val()].members)) {
+                const sanitizedGroup = DOMPurify.sanitize($el.attr('data-group'))
+                if (!(userName in that.groups[$(sanitizedGroup).val()].members)) {
                   const nameAndZone = userName.split('#')
                   results.push({
                     id: userName,
@@ -2209,12 +2214,10 @@ $(function () {
       })
 
       // Group creation {{{
-
       $('#f-group-create-prefix-div a').on('click', function (e) {
         // Select new group prefix.
-        const newPrefix = $(this).attr('data-value')
+        const newPrefix = DOMPurify.sanitize($(this).attr('data-value'))
         const oldPrefix = $('#f-group-create-name').attr('data-prefix')
-
         $('#f-group-create-prefix-div button .text').html(newPrefix + '&nbsp;')
         $('#f-group-create-name').attr('data-prefix', newPrefix)
 
diff --git a/group_manager/templates/group_manager/index.html b/group_manager/templates/group_manager/index.html
index 9328477e..9dbb4221 100644
--- a/group_manager/templates/group_manager/index.html
+++ b/group_manager/templates/group_manager/index.html
@@ -9,6 +9,7 @@
 {% endblock style %}
 
 {% block scripts %}
+    <script src="{{ url_for('static', filename='lib/purify-3.1.6/js/purify.min.js') }}"></script>
     <script src="{{ url_for('group_manager_bp.static', filename='js/group_manager.js') }}"></script>
     <script src="{{ url_for('group_manager_bp.static', filename='lib/select2/select2.full.min.js') }}"></script>
     <script>
diff --git a/research/static/research/js/dlgFileBrowseOperations.js b/research/static/research/js/dlgFileBrowseOperations.js
index 596e0de4..72ccd4e6 100644
--- a/research/static/research/js/dlgFileBrowseOperations.js
+++ b/research/static/research/js/dlgFileBrowseOperations.js
@@ -1,4 +1,4 @@
-/* global browse */
+/* global browse, DOMPurify */
 'use strict'
 
 let folderSelectBrowser = null
@@ -126,7 +126,7 @@ $(document).ready(function () {
                     <td class="item-progress">-</td>
                 </tr>
                 `
-        $('.multi-select-table tbody').append(row)
+        $('.multi-select-table tbody').append(DOMPurify.sanitize(row))
       })
 
       if (action === 'multiple-delete') {
@@ -707,7 +707,7 @@ function dlgMakeBreadcrumb (urlEncodedDir) {
 /// alert handling
 function dlgSelectAlertShow (errorMessage) {
   $('#dlg-select-alert-panel').removeClass('hide')
-  $('#dlg-select-alert-panel span').html(errorMessage)
+  $('#dlg-select-alert-panel span').html(DOMPurify.sanitize(errorMessage))
 }
 
 function dlgSelectAlertHide () {
diff --git a/research/templates/research/browse.html b/research/templates/research/browse.html
index ba0212e7..6c1cc893 100644
--- a/research/templates/research/browse.html
+++ b/research/templates/research/browse.html
@@ -3,6 +3,7 @@
 {% block title %}{{ super() }} &dash; Research{% endblock title %}
 
 {% block scripts %}
+<script src="{{ url_for('static', filename='lib/purify-3.1.6/js/purify.min.js') }}"></script>
 <script src="{{ url_for('static', filename='lib/datatables-1.13.5/datatables.min.js') }}"></script>
 <script src="{{ url_for('research_bp.static', filename='lib/flow-js/flow.min.js') }}"></script>
 <script src="{{ url_for('research_bp.static', filename='js/research.js') }}"></script>
diff --git a/search/static/search/js/revision.js b/search/static/search/js/revision.js
index 97375958..2dd25ef1 100644
--- a/search/static/search/js/revision.js
+++ b/search/static/search/js/revision.js
@@ -1,3 +1,4 @@
+/* global DOMPurify */
 'use strict'
 
 // Handles content of two tables
@@ -412,7 +413,8 @@ $(document).ready(function () {
     $('#newFileName').val($('#org_folder_select_filename').val()) // Is in dialog where to enter a new name when duplicate
 
     // For error reporting
-    $('.mode-dlg-exists .alert-warning').html('The file name <b>' + $('#org_folder_select_filename').val() + '</b> (location: ' + $('#org_folder_select_path').val() + ') already exists')
+    const errorReport = DOMPurify.sanitize('The file name <b>' + $('#org_folder_select_filename').val() + '</b> (location: ' + $('#org_folder_select_path').val() + ') already exists')
+    $('.mode-dlg-exists .alert-warning').html(errorReport)
 
     restoreRevision('restore_no_overwrite')
   })
@@ -453,7 +455,7 @@ $(document).ready(function () {
 
 // select-folder
 function dlgAlertShow (alertMessage) {
-  $('.alert-folder-select').html(alertMessage)
+  $('.alert-folder-select').html(DOMPurify.sanitize(alertMessage))
 }
 
 // dlg-select-folder
@@ -593,7 +595,7 @@ async function restoreRevision (overwriteFlag) {
 
 // Alerts to user in dialog when file already exists
 function dlgAlreadyExistsAlert (message) {
-  $('.alert-dlg-already-exists').html(message)
+  $('.alert-dlg-already-exists').html(DOMPurify.sanitize(message))
 }
 
 /// ////////////////////////////////////////////////////////////////////////////////////////////////////////
diff --git a/search/static/search/js/search.js b/search/static/search/js/search.js
index 82f52918..c80b9971 100644
--- a/search/static/search/js/search.js
+++ b/search/static/search/js/search.js
@@ -1,3 +1,4 @@
+/* global DOMPurify */
 'use strict'
 
 let currentSearchString
@@ -30,7 +31,8 @@ $(document).ready(function () {
   }
 
   $('#search-panel a').on('click', function () {
-    $('#search_concept').html($(this).text())
+    const sanitizedSearchConcept = DOMPurify.sanitize($(this).text())
+    $('#search_concept').html(sanitizedSearchConcept)
     $('#search_concept').attr('data-type', $(this).attr('data-type'))
 
     if ($(this).attr('data-type') === 'status') {
diff --git a/search/templates/search/search.html b/search/templates/search/search.html
index 9ab41911..a0b0feeb 100644
--- a/search/templates/search/search.html
+++ b/search/templates/search/search.html
@@ -3,6 +3,7 @@
 {% block title %}{{ super() }} &dash; Search{% endblock title %}
 
 {% block scripts %}
+<script src="{{ url_for('static', filename='lib/purify-3.1.6/js/purify.min.js') }}"></script>
 <script src="{{ url_for('static', filename='lib/datatables-1.13.5/datatables.min.js') }}"></script>
 <script src="{{ url_for('search_bp.static', filename='js/revision.js') }}"></script>
 <script src="{{ url_for('search_bp.static', filename='js/search.js') }}"></script>
diff --git a/vault/static/vault/js/dlgSelectCollection.js b/vault/static/vault/js/dlgSelectCollection.js
index 7a9a6317..f88b3731 100644
--- a/vault/static/vault/js/dlgSelectCollection.js
+++ b/vault/static/vault/js/dlgSelectCollection.js
@@ -1,3 +1,4 @@
+/* global DOMPurify */
 'use strict'
 
 let urlEncodedPath = ''
@@ -100,7 +101,7 @@ function dlgShowFolderSelectDialog (orgPath) {
 /// alert handling
 function dlgSelectAlertShow (errorMessage) {
   $('#dlg-select-alert-panel').removeClass('hide')
-  $('#dlg-select-alert-panel span').html(errorMessage)
+  $('#dlg-select-alert-panel span').html(DOMPurify.sanitize(errorMessage))
 }
 
 function dlgSelectAlertHide () {
diff --git a/vault/templates/vault/browse.html b/vault/templates/vault/browse.html
index 21595821..a0b6c1bb 100644
--- a/vault/templates/vault/browse.html
+++ b/vault/templates/vault/browse.html
@@ -8,6 +8,7 @@
 {% endblock style %}
 
 {% block scripts %}
+<script src="{{ url_for('static', filename='lib/purify-3.1.6/js/purify.min.js') }}"></script>
 <script src="{{ url_for('static', filename='lib/datatables-1.13.5/datatables.min.js') }}"></script>
 <script src="{{ url_for('vault_bp.static', filename='js/vault.js') }}"></script>
 <script src="{{ url_for('vault_bp.static', filename='js/dlgSelectCollection.js') }}"></script>

From 5f1254c7473e9e7a651a8f261c7cd9a9c4daa97e Mon Sep 17 00:00:00 2001
From: Lazlo Westerhof <l.r.westerhof@uu.nl>
Date: Tue, 13 Aug 2024 09:25:37 +0200
Subject: [PATCH 2/5] Do not use entity references

---
 admin/templates/admin/admin.html                               | 2 +-
 datarequest/templates/datarequest/add.html                     | 2 +-
 datarequest/templates/datarequest/add_attachments.html         | 2 +-
 datarequest/templates/datarequest/assign.html                  | 2 +-
 datarequest/templates/datarequest/dao_evaluate.html            | 2 +-
 datarequest/templates/datarequest/datamanager_review.html      | 2 +-
 datarequest/templates/datarequest/evaluate.html                | 2 +-
 datarequest/templates/datarequest/index.html                   | 2 +-
 datarequest/templates/datarequest/preliminary_review.html      | 2 +-
 datarequest/templates/datarequest/preregister.html             | 2 +-
 datarequest/templates/datarequest/preregistration_confirm.html | 2 +-
 datarequest/templates/datarequest/review.html                  | 2 +-
 datarequest/templates/datarequest/view.html                    | 2 +-
 deposit/templates/deposit/data.html                            | 2 +-
 deposit/templates/deposit/metadata-form.html                   | 2 +-
 deposit/templates/deposit/overview.html                        | 2 +-
 deposit/templates/deposit/submit.html                          | 2 +-
 deposit/templates/deposit/thank-you.html                       | 2 +-
 fileviewer/templates/fileviewer/file.html                      | 2 +-
 general/templates/general/403.html                             | 2 +-
 general/templates/general/404.html                             | 2 +-
 general/templates/general/500.html                             | 2 +-
 general/templates/general/index.html                           | 2 +-
 group_manager/templates/group_manager/index.html               | 2 +-
 intake/templates/intake/intake.html                            | 2 +-
 intake/templates/intake/reports.html                           | 2 +-
 open_search/templates/open_search/search.html                  | 2 +-
 research/templates/research/browse.html                        | 2 +-
 research/templates/research/metadata-form.html                 | 2 +-
 search/templates/search/search.html                            | 2 +-
 stats/templates/stats/stats.html                               | 2 +-
 themes/uu_dag/vault/browse.html                                | 2 +-
 themes/uu_dgk/index.html                                       | 2 +-
 themes/uu_fsw/index.html                                       | 2 +-
 themes/uu_geo/index.html                                       | 2 +-
 themes/uu_gw/index.html                                        | 2 +-
 themes/uu_i-lab/index.html                                     | 2 +-
 themes/uu_its/index.html                                       | 2 +-
 themes/uu_science/index.html                                   | 2 +-
 themes/uu_youth/index.html                                     | 2 +-
 themes/vu/index.html                                           | 2 +-
 user/templates/user/data_access.html                           | 2 +-
 user/templates/user/data_transfer.html                         | 2 +-
 user/templates/user/gate.html                                  | 2 +-
 user/templates/user/login.html                                 | 2 +-
 user/templates/user/notifications.html                         | 2 +-
 user/templates/user/settings.html                              | 2 +-
 vault/templates/vault/browse.html                              | 2 +-
 vault/templates/vault/datapackage.html                         | 2 +-
 vault/templates/vault/metadata-form.html                       | 2 +-
 50 files changed, 50 insertions(+), 50 deletions(-)

diff --git a/admin/templates/admin/admin.html b/admin/templates/admin/admin.html
index 7c8f78b0..9512253d 100644
--- a/admin/templates/admin/admin.html
+++ b/admin/templates/admin/admin.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Administration{% endblock title %}
+{% block title %}{{ super() }} - Administration{% endblock title %}
 
 {% block scripts %}
 <script src="{{ url_for('static', filename='lib/purify-3.1.6/js/purify.min.js') }}"></script>
diff --git a/datarequest/templates/datarequest/add.html b/datarequest/templates/datarequest/add.html
index 720fd782..ac0e6b8c 100644
--- a/datarequest/templates/datarequest/add.html
+++ b/datarequest/templates/datarequest/add.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Add request{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Add request{% endblock title %}
 
 {% block scripts %}
 <script> window.config = {
diff --git a/datarequest/templates/datarequest/add_attachments.html b/datarequest/templates/datarequest/add_attachments.html
index bff1ff90..5cb95e84 100644
--- a/datarequest/templates/datarequest/add_attachments.html
+++ b/datarequest/templates/datarequest/add_attachments.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Add attachments{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Add attachments{% endblock title %}
 
 {% block scripts %}
 <script> window.config = {
diff --git a/datarequest/templates/datarequest/assign.html b/datarequest/templates/datarequest/assign.html
index 1c51e3d7..e77a9d1a 100644
--- a/datarequest/templates/datarequest/assign.html
+++ b/datarequest/templates/datarequest/assign.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Assign request{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Assign request{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/forms.css') }}">
diff --git a/datarequest/templates/datarequest/dao_evaluate.html b/datarequest/templates/datarequest/dao_evaluate.html
index 2b4226d6..ef9dc7c6 100644
--- a/datarequest/templates/datarequest/dao_evaluate.html
+++ b/datarequest/templates/datarequest/dao_evaluate.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Evaluate DAO request{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Evaluate DAO request{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/forms.css') }}">
diff --git a/datarequest/templates/datarequest/datamanager_review.html b/datarequest/templates/datarequest/datamanager_review.html
index f0f9f028..80552210 100644
--- a/datarequest/templates/datarequest/datamanager_review.html
+++ b/datarequest/templates/datarequest/datamanager_review.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Datamanager review{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Datamanager review{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/forms.css') }}">
diff --git a/datarequest/templates/datarequest/evaluate.html b/datarequest/templates/datarequest/evaluate.html
index 8394df60..96db61e2 100644
--- a/datarequest/templates/datarequest/evaluate.html
+++ b/datarequest/templates/datarequest/evaluate.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Evaluate request{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Evaluate request{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/forms.css') }}">
diff --git a/datarequest/templates/datarequest/index.html b/datarequest/templates/datarequest/index.html
index 8ea47311..7ae11ec2 100644
--- a/datarequest/templates/datarequest/index.html
+++ b/datarequest/templates/datarequest/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequests overview{% endblock title %}
+{% block title %}{{ super() }} - Datarequests overview{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('static', filename='lib/datatables-1.13.5/datatables.min.css') }}">
diff --git a/datarequest/templates/datarequest/preliminary_review.html b/datarequest/templates/datarequest/preliminary_review.html
index f6444b7c..19acdd9c 100644
--- a/datarequest/templates/datarequest/preliminary_review.html
+++ b/datarequest/templates/datarequest/preliminary_review.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Preliminary review{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Preliminary review{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/forms.css') }}">
diff --git a/datarequest/templates/datarequest/preregister.html b/datarequest/templates/datarequest/preregister.html
index 3e1996b9..c9da3947 100644
--- a/datarequest/templates/datarequest/preregister.html
+++ b/datarequest/templates/datarequest/preregister.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Preregistration{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Preregistration{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/forms.css') }}">
diff --git a/datarequest/templates/datarequest/preregistration_confirm.html b/datarequest/templates/datarequest/preregistration_confirm.html
index a7e55dd4..462899a5 100644
--- a/datarequest/templates/datarequest/preregistration_confirm.html
+++ b/datarequest/templates/datarequest/preregistration_confirm.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Preregistration confirmation{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Preregistration confirmation{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/forms.css') }}">
diff --git a/datarequest/templates/datarequest/review.html b/datarequest/templates/datarequest/review.html
index 26435f6d..89773d85 100644
--- a/datarequest/templates/datarequest/review.html
+++ b/datarequest/templates/datarequest/review.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }} &dash; Review{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }} - Review{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/forms.css') }}">
diff --git a/datarequest/templates/datarequest/view.html b/datarequest/templates/datarequest/view.html
index 10f98e85..bd0e2d38 100644
--- a/datarequest/templates/datarequest/view.html
+++ b/datarequest/templates/datarequest/view.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Datarequest {{ request_id }}{% endblock title %}
+{% block title %}{{ super() }} - Datarequest {{ request_id }}{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('datarequest_bp.static', filename='css/view.css') }}">
diff --git a/deposit/templates/deposit/data.html b/deposit/templates/deposit/data.html
index 24e6d34e..17118338 100644
--- a/deposit/templates/deposit/data.html
+++ b/deposit/templates/deposit/data.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Deposit &dash; Add data{% endblock title %}
+{% block title %}{{ super() }} - Deposit - Add data{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('static', filename='lib/datatables-1.13.5/datatables.min.css') }}">
diff --git a/deposit/templates/deposit/metadata-form.html b/deposit/templates/deposit/metadata-form.html
index 307a893b..e6008cce 100644
--- a/deposit/templates/deposit/metadata-form.html
+++ b/deposit/templates/deposit/metadata-form.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Deposit &dash; Document data {% endblock title %}
+{% block title %}{{ super() }} - Deposit - Document data {% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('deposit_bp.static', filename='lib/sweetalert/sweetalert.css') }}">
diff --git a/deposit/templates/deposit/overview.html b/deposit/templates/deposit/overview.html
index e400d4b6..05d6dfe9 100644
--- a/deposit/templates/deposit/overview.html
+++ b/deposit/templates/deposit/overview.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Deposit &dash; My deposits{% endblock title %}
+{% block title %}{{ super() }} - Deposit - My deposits{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('static', filename='lib/datatables-1.13.5/datatables.min.css') }}">
diff --git a/deposit/templates/deposit/submit.html b/deposit/templates/deposit/submit.html
index cc4ed723..6c390cf6 100644
--- a/deposit/templates/deposit/submit.html
+++ b/deposit/templates/deposit/submit.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Deposit &dash; Submit data{% endblock title %}
+{% block title %}{{ super() }} - Deposit - Submit data{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('deposit_bp.static', filename='lib/stepper/bs-stepper.custom.css') }}">
diff --git a/deposit/templates/deposit/thank-you.html b/deposit/templates/deposit/thank-you.html
index fecf945c..bcfc6d6a 100644
--- a/deposit/templates/deposit/thank-you.html
+++ b/deposit/templates/deposit/thank-you.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Deposit &dash; Thank you{% endblock title %}
+{% block title %}{{ super() }} - Deposit - Thank you{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('deposit_bp.static', filename='css/deposit.css') }}">
diff --git a/fileviewer/templates/fileviewer/file.html b/fileviewer/templates/fileviewer/file.html
index afa7448f..2f2360f7 100644
--- a/fileviewer/templates/fileviewer/file.html
+++ b/fileviewer/templates/fileviewer/file.html
@@ -1,6 +1,6 @@
 {% extends 'base-bare.html' %}
 
-{% block title %}{{ super() }} &dash; File Viewer{% endblock title %}
+{% block title %}{{ super() }} - File Viewer{% endblock title %}
 
 {% block style %}
 <link id='pagestyle' rel="stylesheet" {% if g.settings and g.settings.color_mode and g.settings.color_mode == 'DARK' %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/dark.min.css')}}"{% else %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/default.min.css')}}"{% endif %}>
diff --git a/general/templates/general/403.html b/general/templates/general/403.html
index 6ec741b2..5cf72222 100644
--- a/general/templates/general/403.html
+++ b/general/templates/general/403.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Access forbidden{% endblock title %}
+{% block title %}{{ super() }} - Access forbidden{% endblock title %}
 
 {% block content %}
 <div class="text-center">
diff --git a/general/templates/general/404.html b/general/templates/general/404.html
index 1e5b84b2..8f2c4fec 100644
--- a/general/templates/general/404.html
+++ b/general/templates/general/404.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Page not found{% endblock title %}
+{% block title %}{{ super() }} - Page not found{% endblock title %}
 
 {% block content %}
 <div class="text-center">
diff --git a/general/templates/general/500.html b/general/templates/general/500.html
index 734eea40..33c706a3 100644
--- a/general/templates/general/500.html
+++ b/general/templates/general/500.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Internal server error{% endblock title %}
+{% block title %}{{ super() }} - Internal server error{% endblock title %}
 
 {% block content %}
 <div class="text-center">
diff --git a/general/templates/general/index.html b/general/templates/general/index.html
index 287dd80a..16a9913a 100644
--- a/general/templates/general/index.html
+++ b/general/templates/general/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock title %}
+{% block title %}{{ super() }} - Home{% endblock title %}
 
 {% block style %}
 {{ super() }}
diff --git a/group_manager/templates/group_manager/index.html b/group_manager/templates/group_manager/index.html
index 9dbb4221..f58af8f1 100644
--- a/group_manager/templates/group_manager/index.html
+++ b/group_manager/templates/group_manager/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Group Manager{% endblock title %}
+{% block title %}{{ super() }} - Group Manager{% endblock title %}
 
 {% block style %}
     <link rel="stylesheet" href="{{ url_for('group_manager_bp.static', filename='css/group_manager.css') }}">
diff --git a/intake/templates/intake/intake.html b/intake/templates/intake/intake.html
index af5d37a5..cf0df18a 100644
--- a/intake/templates/intake/intake.html
+++ b/intake/templates/intake/intake.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Intake{% endblock title %}
+{% block title %}{{ super() }} - Intake{% endblock title %}
 
 {% block style %}
     <link rel="stylesheet" href="{{ url_for('intake_bp.static', filename='css/jquery.dataTables.css') }}">
diff --git a/intake/templates/intake/reports.html b/intake/templates/intake/reports.html
index 13497ff7..eef2c8d0 100644
--- a/intake/templates/intake/reports.html
+++ b/intake/templates/intake/reports.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Intake{% endblock title %}
+{% block title %}{{ super() }} - Intake{% endblock title %}
 
 {% block style %}
     <link rel="stylesheet" href="{{ url_for('intake_bp.static', filename='css/intake.css') }}">
diff --git a/open_search/templates/open_search/search.html b/open_search/templates/open_search/search.html
index e887f402..ae6804bd 100644
--- a/open_search/templates/open_search/search.html
+++ b/open_search/templates/open_search/search.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Open Search{% endblock title %}
+{% block title %}{{ super() }} - Open Search{% endblock title %}
 
 {% block scripts %}
 <script src="{{ url_for('open_search_bp.static', filename='js/search.js') }}"></script>
diff --git a/research/templates/research/browse.html b/research/templates/research/browse.html
index 6c1cc893..289474a5 100644
--- a/research/templates/research/browse.html
+++ b/research/templates/research/browse.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Research{% endblock title %}
+{% block title %}{{ super() }} - Research{% endblock title %}
 
 {% block scripts %}
 <script src="{{ url_for('static', filename='lib/purify-3.1.6/js/purify.min.js') }}"></script>
diff --git a/research/templates/research/metadata-form.html b/research/templates/research/metadata-form.html
index a2125f7b..719fc29d 100644
--- a/research/templates/research/metadata-form.html
+++ b/research/templates/research/metadata-form.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Research{% endblock title %}
+{% block title %}{{ super() }} - Research{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('research_bp.static', filename='lib/sweetalert/sweetalert.css') }}">
diff --git a/search/templates/search/search.html b/search/templates/search/search.html
index a0b0feeb..3d3feebd 100644
--- a/search/templates/search/search.html
+++ b/search/templates/search/search.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Search{% endblock title %}
+{% block title %}{{ super() }} - Search{% endblock title %}
 
 {% block scripts %}
 <script src="{{ url_for('static', filename='lib/purify-3.1.6/js/purify.min.js') }}"></script>
diff --git a/stats/templates/stats/stats.html b/stats/templates/stats/stats.html
index 0745d10f..f33ca1db 100644
--- a/stats/templates/stats/stats.html
+++ b/stats/templates/stats/stats.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Statistics{% endblock title %}
+{% block title %}{{ super() }} - Statistics{% endblock title %}
 
 {% block style %}
     <link rel="stylesheet" href="{{ url_for('static', filename='lib/datatables-1.13.5/datatables.min.css') }}">
diff --git a/themes/uu_dag/vault/browse.html b/themes/uu_dag/vault/browse.html
index 3d6ee00a..1fa581e2 100644
--- a/themes/uu_dag/vault/browse.html
+++ b/themes/uu_dag/vault/browse.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Vault{% endblock title %}
+{% block title %}{{ super() }} - Vault{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('vault_bp.static', filename='css/vault.css') }}">
diff --git a/themes/uu_dgk/index.html b/themes/uu_dgk/index.html
index 12409f9b..b2491d69 100644
--- a/themes/uu_dgk/index.html
+++ b/themes/uu_dgk/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/themes/uu_fsw/index.html b/themes/uu_fsw/index.html
index 8c57809e..2499bcfc 100644
--- a/themes/uu_fsw/index.html
+++ b/themes/uu_fsw/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/themes/uu_geo/index.html b/themes/uu_geo/index.html
index da8637b8..772db3e4 100644
--- a/themes/uu_geo/index.html
+++ b/themes/uu_geo/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/themes/uu_gw/index.html b/themes/uu_gw/index.html
index 7022deba..1042c6a0 100644
--- a/themes/uu_gw/index.html
+++ b/themes/uu_gw/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/themes/uu_i-lab/index.html b/themes/uu_i-lab/index.html
index 36a03641..d40242f9 100644
--- a/themes/uu_i-lab/index.html
+++ b/themes/uu_i-lab/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/themes/uu_its/index.html b/themes/uu_its/index.html
index 5a52c004..b740d181 100644
--- a/themes/uu_its/index.html
+++ b/themes/uu_its/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/themes/uu_science/index.html b/themes/uu_science/index.html
index 49085a84..c6441faf 100644
--- a/themes/uu_science/index.html
+++ b/themes/uu_science/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/themes/uu_youth/index.html b/themes/uu_youth/index.html
index cc3f44d0..0278b121 100644
--- a/themes/uu_youth/index.html
+++ b/themes/uu_youth/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/themes/vu/index.html b/themes/vu/index.html
index 81b13b5b..47e77815 100644
--- a/themes/vu/index.html
+++ b/themes/vu/index.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Home{% endblock %}
+{% block title %}{{ super() }} - Home{% endblock %}
 
 {% block style %}
 {{ super() }}
diff --git a/user/templates/user/data_access.html b/user/templates/user/data_access.html
index 1d424452..3cd3761e 100644
--- a/user/templates/user/data_access.html
+++ b/user/templates/user/data_access.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Data Access Tokens{% endblock %}
+{% block title %}{{ super() }} - Data Access Tokens{% endblock %}
 
 {% block scripts %}
     <script src="{{ url_for('user_bp.static', filename='js/data_access.js') }}"></script>
diff --git a/user/templates/user/data_transfer.html b/user/templates/user/data_transfer.html
index 4ae2256c..05239750 100644
--- a/user/templates/user/data_transfer.html
+++ b/user/templates/user/data_transfer.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Data Transfer{% endblock %}
+{% block title %}{{ super() }} - Data Transfer{% endblock %}
 
 {% block scripts %}
     <script src="{{ url_for('user_bp.static', filename='js/data_transfer.js') }}"></script>
diff --git a/user/templates/user/gate.html b/user/templates/user/gate.html
index 20fc7b37..79f3918f 100644
--- a/user/templates/user/gate.html
+++ b/user/templates/user/gate.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Sign in{% endblock title %}
+{% block title %}{{ super() }} - Sign in{% endblock title %}
 
 {% block content %}
 <div class="row">
diff --git a/user/templates/user/login.html b/user/templates/user/login.html
index a0f7062e..2b1c9039 100644
--- a/user/templates/user/login.html
+++ b/user/templates/user/login.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Sign in{% endblock title %}
+{% block title %}{{ super() }} - Sign in{% endblock title %}
 
 {% block content %}
 <div
diff --git a/user/templates/user/notifications.html b/user/templates/user/notifications.html
index 22907016..e9861277 100644
--- a/user/templates/user/notifications.html
+++ b/user/templates/user/notifications.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Notifications{% endblock title %}
+{% block title %}{{ super() }} - Notifications{% endblock title %}
 
 {% block scripts %}
     <script src="{{ url_for('user_bp.static', filename='js/notifications.js') }}"></script>
diff --git a/user/templates/user/settings.html b/user/templates/user/settings.html
index 797db13f..e1a3f1e6 100644
--- a/user/templates/user/settings.html
+++ b/user/templates/user/settings.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Settings{% endblock title %}
+{% block title %}{{ super() }} - Settings{% endblock title %}
 
 {% block content %}
 <h1>Settings</h1>
diff --git a/vault/templates/vault/browse.html b/vault/templates/vault/browse.html
index a0b6c1bb..f0661795 100644
--- a/vault/templates/vault/browse.html
+++ b/vault/templates/vault/browse.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Vault{% endblock title %}
+{% block title %}{{ super() }} - Vault{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('vault_bp.static', filename='css/vault.css') }}">
diff --git a/vault/templates/vault/datapackage.html b/vault/templates/vault/datapackage.html
index 929a078c..297fec31 100644
--- a/vault/templates/vault/datapackage.html
+++ b/vault/templates/vault/datapackage.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; DAG Datapackage{% endblock title %}
+{% block title %}{{ super() }} - DAG Datapackage{% endblock title %}
 
 {% block style %}
 <link rel="stylesheet" href="{{ url_for('vault_bp.static', filename='css/vault.css') }}">
diff --git a/vault/templates/vault/metadata-form.html b/vault/templates/vault/metadata-form.html
index 7b02bb09..2830ab72 100644
--- a/vault/templates/vault/metadata-form.html
+++ b/vault/templates/vault/metadata-form.html
@@ -1,6 +1,6 @@
 {% extends 'base.html' %}
 
-{% block title %}{{ super() }} &dash; Vault{% endblock title %}
+{% block title %}{{ super() }} - Vault{% endblock title %}
 
 {% block scripts %}
 <script>

From ccd3ff800bd783413fc3a5a14c054bd3b131c969 Mon Sep 17 00:00:00 2001
From: Lazlo Westerhof <l.r.westerhof@uu.nl>
Date: Tue, 13 Aug 2024 09:28:24 +0200
Subject: [PATCH 3/5] Use lowercase form method values

---
 admin/templates/admin/admin.html                 | 8 ++++----
 group_manager/templates/group_manager/index.html | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/admin/templates/admin/admin.html b/admin/templates/admin/admin.html
index 9512253d..e35c685f 100644
--- a/admin/templates/admin/admin.html
+++ b/admin/templates/admin/admin.html
@@ -19,7 +19,7 @@ <h1>Administration</h1>
                 <h2 class="card-title">Set Maintenance Banner</h2>
                 <div class="d-flex justify-content-start align-items-end" style="width: 100%;">
                     <!-- Form to set a maintenance banner -->
-                    <form action="{{ url_for('admin_bp.set_banner') }}" method="POST"
+                    <form action="{{ url_for('admin_bp.set_banner') }}" method="post"
                         class="flex-fill me-2 needs-validation" novalidate>
                         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                         <!-- Text area for entering banner details -->
@@ -38,7 +38,7 @@ <h2 class="card-title">Set Maintenance Banner</h2>
                         <button type="submit" class="btn btn-primary" name="Set Banner">Set Banner</button>
                     </form>
                     <!-- Form to remove the maintenance banner -->
-                    <form action="{{ url_for('admin_bp.remove_banner') }}" method="POST" class="flex-shrink-1">
+                    <form action="{{ url_for('admin_bp.remove_banner') }}" method="post" class="flex-shrink-1">
                         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                         <button type="submit" class="btn btn-secondary" name="Remove Banner">Remove Banner</button>
                     </form>
@@ -50,7 +50,7 @@ <h2 class="card-title">Set Maintenance Banner</h2>
         <section class="card my-3">
             <div class="card-body">
                 <h2 class="card-title">Change Portal Theme</h2>
-                <form action="{{ url_for('admin_bp.set_theme') }}" method="POST" class="needs-validation" novalidate>
+                <form action="{{ url_for('admin_bp.set_theme') }}" method="post" class="needs-validation" novalidate>
                     <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                     <div class="mb-3">
                         <label for="theme">Select Theme:</label>
@@ -73,7 +73,7 @@ <h2 class="card-title">Change Portal Theme</h2>
                 <h2 class="card-title">Update Publication Terms</h2>
                 <div class="d-flex justify-content-start align-items-end" style="width: 100%;">
                     <!-- Form to update publication terms -->
-                    <form action="{{ url_for('admin_bp.set_publication_terms') }}" method="POST"
+                    <form action="{{ url_for('admin_bp.set_publication_terms') }}" method="post"
                         class="flex-fill me-2 needs-validation" novalidate>
                         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                         <div class="mb-3">
diff --git a/group_manager/templates/group_manager/index.html b/group_manager/templates/group_manager/index.html
index f58af8f1..7b5f968a 100644
--- a/group_manager/templates/group_manager/index.html
+++ b/group_manager/templates/group_manager/index.html
@@ -97,7 +97,7 @@ <h1 id="group-manager-text">Group manager</h1>
             <div class="card properties-create hidden">
                 <div class="card-header">Create new group</div>
                 <div class="card-body" id="group-properties-create">
-                    <form class="form-horizontal" id="f-group-create" action="{{ url_for('group_manager_bp.group_create') }}" method="POST">
+                    <form class="form-horizontal" id="f-group-create" action="{{ url_for('group_manager_bp.group_create') }}" method="post">
                         <div class="mb-3 row">
                             <label class="col-sm-4 form-label" for="f-group-create-name">Group name
                                 <i class="fa-solid fa-question-circle" aria-hidden="true" title="Name and type for this group, this cannot be changed after group creation (may only contain lowercase letters (a-z) and hyphens (-))"></i>
@@ -211,7 +211,7 @@ <h1 id="group-manager-text">Group manager</h1>
                     <p class="placeholder-text">
                         Please select a group.
                     </p>
-                    <form action="{{ url_for('group_manager_bp.group_update') }}" method="POST" id="f-group-update" class="hidden">
+                    <form action="{{ url_for('group_manager_bp.group_update') }}" method="post" id="f-group-update" class="hidden">
 
                         <div class="mb-3 row">
                             <label class="col-sm-4 form-label" for="f-group-update-name">Group name
@@ -323,7 +323,7 @@ <h1 id="group-manager-text">Group manager</h1>
                 </div>
                 <div class="list-group overflow-auto" id="user-list" style="max-height: 243px"></div>
                 <div class="list-group-item item-user-create" id="user-list-add-user" hidden>
-                    <form action="{{ url_for('group_manager_bp.user_create') }}" method="POST" class="form-inline" id="f-user-create">
+                    <form action="{{ url_for('group_manager_bp.user_create') }}" method="post" class="form-inline" id="f-user-create">
                         <input name="group_name" id="f-user-create-group" type="hidden" />
                         <div class="input-group">
                             <select name="user_name" id="f-user-create-name" class="form-control form-control-sm selectify-user-name" required data-group="#f-user-create-group" >

From 8d9674344952441cc5cd9385862c9b00661fa3bd Mon Sep 17 00:00:00 2001
From: Lazlo Westerhof <l.r.westerhof@uu.nl>
Date: Tue, 13 Aug 2024 09:52:50 +0200
Subject: [PATCH 4/5] Attributes should be double quote

---
 fileviewer/templates/fileviewer/file.html | 2 +-
 user/templates/user/data_transfer.html    | 2 +-
 vault/templates/vault/browse.html         | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/fileviewer/templates/fileviewer/file.html b/fileviewer/templates/fileviewer/file.html
index 2f2360f7..3e89acd1 100644
--- a/fileviewer/templates/fileviewer/file.html
+++ b/fileviewer/templates/fileviewer/file.html
@@ -3,7 +3,7 @@
 {% block title %}{{ super() }} - File Viewer{% endblock title %}
 
 {% block style %}
-<link id='pagestyle' rel="stylesheet" {% if g.settings and g.settings.color_mode and g.settings.color_mode == 'DARK' %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/dark.min.css')}}"{% else %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/default.min.css')}}"{% endif %}>
+<link id="pagestyle" rel="stylesheet" {% if g.settings and g.settings.color_mode and g.settings.color_mode == 'DARK' %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/dark.min.css')}}"{% else %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/default.min.css')}}"{% endif %}>
 {% endblock style %}
 
 {% block scripts %}
diff --git a/user/templates/user/data_transfer.html b/user/templates/user/data_transfer.html
index 05239750..df9991f8 100644
--- a/user/templates/user/data_transfer.html
+++ b/user/templates/user/data_transfer.html
@@ -21,7 +21,7 @@
 {% endblock %}
 
 {% block style %}
-    <link id='pagestyle' rel="stylesheet" {% if g.settings and g.settings.color_mode and g.settings.color_mode == 'DARK' %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/dark.min.css')}}"{% else %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/default.min.css')}}"{% endif %}>
+    <link id="pagestyle" rel="stylesheet" {% if g.settings and g.settings.color_mode and g.settings.color_mode == 'DARK' %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/dark.min.css')}}"{% else %}href="{{url_for('static', filename='lib/highlight-js-11.9.0/styles/default.min.css')}}"{% endif %}>
 {% endblock style %}
 
 {% block content %}
diff --git a/vault/templates/vault/browse.html b/vault/templates/vault/browse.html
index f0661795..0c23a61f 100644
--- a/vault/templates/vault/browse.html
+++ b/vault/templates/vault/browse.html
@@ -253,7 +253,7 @@ <h5 class="modal-title">Download datapackage</h5>
             </div>
             <div class="modal-footer">
                 <button class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                <button class='btn btn-primary action-confirm-vault-download'>Confirm download</button>
+                <button class="btn btn-primary action-confirm-vault-download">Confirm download</button>
             </div>
         </div>
     </div>
@@ -271,7 +271,7 @@ <h5 class="modal-title">Archive datapackage to tape</h5>
             </div>
             <div class="modal-footer">
                 <button class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                <button class='btn btn-primary action-confirm-vault-archival'>Confirm archive</button>
+                <button class="btn btn-primary action-confirm-vault-archival">Confirm archive</button>
             </div>
         </div>
     </div>
@@ -289,7 +289,7 @@ <h5 class="modal-title">Unarchive datapackage from tape</h5>
             </div>
             <div class="modal-footer">
                 <button class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                <button class='btn btn-primary action-confirm-vault-unarchive'>Confirm unarchive</button>
+                <button class="btn btn-primary action-confirm-vault-unarchive">Confirm unarchive</button>
             </div>
         </div>
     </div>

From 2f60ee17ed33898a2c48efe5ec2204a41a057a4e Mon Sep 17 00:00:00 2001
From: Leonidas Triantafyllou <leonidastri@users.noreply.github.com>
Date: Tue, 13 Aug 2024 16:48:09 +0200
Subject: [PATCH 5/5] YDA-5894: hide download buttons when no checksum report

---
 deposit/static/deposit/js/data.js       | 14 ++++++++++----
 research/static/research/js/research.js | 16 +++++++++++-----
 vault/static/vault/js/vault.js          | 14 ++++++++++----
 3 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/deposit/static/deposit/js/data.js b/deposit/static/deposit/js/data.js
index 643a462d..52280910 100644
--- a/deposit/static/deposit/js/data.js
+++ b/deposit/static/deposit/js/data.js
@@ -158,6 +158,8 @@ $(function () {
 
     $('#showChecksumReport .collection').text(folder)
     $('#showChecksumReport .modal-body #checksumReport').html('')
+    $('#showChecksumReport .modal-footer .download-report-text').addClass('d-none')
+    $('#showChecksumReport .modal-footer .download-report-csv').addClass('d-none')
     $('#showChecksumReport .modal-footer .download-report-text').attr('href', downloadUrl + '&format=text')
     $('#showChecksumReport .modal-footer .download-report-csv').attr('href', downloadUrl + '&format=csv')
 
@@ -167,11 +169,15 @@ $(function () {
 
       table += '<thead><tr><th>Filename</th><th>Size</th><th>Checksum</th></tr></thead>'
       $.each(data, function (index, obj) {
-        table += `<tr>
-                     <td>${obj.name}</td>
-                     <td>${obj.size}</td>
-                     <td>${obj.checksum}</td>
+        if (data.length > 0) {
+          table += `<tr>
+                    <td>${obj.name}</td>
+                    <td>${obj.size}</td>
+                    <td>${obj.checksum}</td>
                 </tr>`
+          $('#showChecksumReport .modal-footer .download-report-text').removeClass('d-none')
+          $('#showChecksumReport .modal-footer .download-report-csv').removeClass('d-none')
+        }
       })
       table += '</tbody></table>'
 
diff --git a/research/static/research/js/research.js b/research/static/research/js/research.js
index 798e6ed4..05b3b85e 100644
--- a/research/static/research/js/research.js
+++ b/research/static/research/js/research.js
@@ -184,6 +184,8 @@ $(function () {
 
     $('#showChecksumReport .collection').text(folder)
     $('#showChecksumReport .modal-body #checksumReport').html('')
+    $('#showChecksumReport .modal-footer .download-report-text').addClass('d-none')
+    $('#showChecksumReport .modal-footer .download-report-csv').addClass('d-none')
     $('#showChecksumReport .modal-footer .download-report-text').attr('href', downloadUrl + '&format=text')
     $('#showChecksumReport .modal-footer .download-report-csv').attr('href', downloadUrl + '&format=csv')
 
@@ -193,11 +195,15 @@ $(function () {
 
       table += '<thead><tr><th>Filename</th><th>Size</th><th>Checksum</th></tr></thead>'
       $.each(data, function (index, obj) {
-        table += `<tr>
-                     <td>${obj.name}</td>
-                     <td>${obj.size}</td>
-                     <td>${obj.checksum}</td>
-                </tr>`
+        if (data.length > 0) {
+          table += `<tr>
+                      <td>${obj.name}</td>
+                      <td>${obj.size}</td>
+                      <td>${obj.checksum}</td>
+                  </tr>`
+          $('#showChecksumReport .modal-footer .download-report-text').removeClass('d-none')
+          $('#showChecksumReport .modal-footer .download-report-csv').removeClass('d-none')
+        }
       })
       table += '</tbody></table>'
 
diff --git a/vault/static/vault/js/vault.js b/vault/static/vault/js/vault.js
index cf9a2b3b..708fc4c1 100644
--- a/vault/static/vault/js/vault.js
+++ b/vault/static/vault/js/vault.js
@@ -49,6 +49,8 @@ $(function () {
 
     $('#showChecksumReport .collection').text(folder)
     $('#showChecksumReport .modal-body #checksumReport').html('')
+    $('#showChecksumReport .modal-footer .download-report-text').addClass('d-none')
+    $('#showChecksumReport .modal-footer .download-report-csv').addClass('d-none')
     $('#showChecksumReport .modal-footer .download-report-text').attr('href', downloadUrl + '&format=text')
     $('#showChecksumReport .modal-footer .download-report-csv').attr('href', downloadUrl + '&format=csv')
 
@@ -58,11 +60,15 @@ $(function () {
 
       table += '<thead><tr><th>Filename</th><th>Size</th><th>Checksum</th></tr></thead>'
       $.each(data, function (index, obj) {
-        table += `<tr>
-                     <td>${obj.name}</td>
-                     <td>${obj.size}</td>
-                     <td>${obj.checksum}</td>
+        if (data.length > 0) {
+          table += `<tr>
+                    <td>${obj.name}</td>
+                    <td>${obj.size}</td>
+                    <td>${obj.checksum}</td>
                 </tr>`
+          $('#showChecksumReport .modal-footer .download-report-text').removeClass('d-none')
+          $('#showChecksumReport .modal-footer .download-report-csv').removeClass('d-none')
+        }
       })
       table += '</tbody></table>'