Fix post edit action

- Add CSRF to post/page list pages (for deletion)

src/MyWebLog/Handlers/Admin.fs

@@ -129,7 +129,8 @@ let listPages pageNbr : HttpHandler = fun next ctx -> task {
     let! pages  = Data.Page.findPageOfPages webLog.id pageNbr ctx.Conn
     return!
         Hash.FromAnonymousObject
-            {| pages      = pages |> List.map (DisplayPage.fromPageMinimal webLog)
+            {|  csrf       = csrfToken ctx
+                pages      = pages |> List.map (DisplayPage.fromPageMinimal webLog)
                 page_title = "Pages"
             |}
         |> viewForTheme "admin" "page-list" next ctx
@@ -191,7 +192,9 @@ let savePagePermalinks : HttpHandler = fun next ctx -> task {
 let deletePage pgId : HttpHandler = fun next ctx -> task {
     let webLog = ctx.WebLog
     match! Data.Page.delete (PageId pgId) webLog.id ctx.Conn with
-    | true  -> do! addMessage ctx { UserMessage.success with message = "Page deleted successfully" }
+    | true ->
+        do! PageListCache.update ctx
+        do! addMessage ctx { UserMessage.success with message = "Page deleted successfully" }
     | false -> do! addMessage ctx { UserMessage.error with message = "Page not found; nothing deleted" }
     return! redirectToGet (WebLog.relativeUrl webLog (Permalink "admin/pages")) next ctx
 }

src/MyWebLog/Handlers/Post.fs

@@ -339,6 +339,7 @@ let all pageNbr : HttpHandler = fun next ctx -> task {
     let! posts  = Data.Post.findPageOfPosts webLog.id pageNbr 25 conn
     let! hash   = preparePostList webLog posts AdminList "" pageNbr 25 ctx conn
     hash.Add ("page_title", "Posts")
+    hash.Add ("csrf", csrfToken ctx)
     return! viewForTheme "admin" "post-list" next ctx hash
 }
 

src/MyWebLog/themes/admin/post-edit.liquid

@@ -1,6 +1,6 @@
 <h2 class="my-3">{{ page_title }}</h2>
 <article>
-  <form action="{{ "/admin/post/save" | relative_link }}" method="post">
+  <form action="{{ "admin/post/save" | relative_link }}" method="post">
     <input type="hidden" name="{{ csrf.form_field_name }}" value="{{ csrf.request_token }}">
     <input type="hidden" name="postId" value="{{ model.post_id }}">
     <div class="container">