From 5296bef65f505e962426639fccfbda9acdd4ab63 Mon Sep 17 00:00:00 2001
From: Daniel Gergely <dgergely@compassion.ch>
Date: Thu, 24 Sep 2026 11:22:02 +0200
Subject: [PATCH 1/2] [T3481] FIX: guard the auth forms against a double submit

---
 .../static/src/js/my2_auth_submit_guard.js    | 46 +++++++++++++++++++
 my_compassion/templates/my2_assets.xml        |  1 +
 2 files changed, 47 insertions(+)
 create mode 100644 my_compassion/static/src/js/my2_auth_submit_guard.js

diff --git a/my_compassion/static/src/js/my2_auth_submit_guard.js b/my_compassion/static/src/js/my2_auth_submit_guard.js
new file mode 100644
index 000000000..0b99f7575
--- /dev/null
+++ b/my_compassion/static/src/js/my2_auth_submit_guard.js
@@ -0,0 +1,46 @@
+/* The auth POSTs can take seconds with no feedback, and a second tap fails CSRF
+   and shows a 400 over the reset that already succeeded (T3481). */
+(function () {
+    "use strict";
+
+    const AUTH_PATHS = ["/web/login", "/web/signup", "/web/reset_password"];
+    const RELEASE_MS = 15000;
+
+    if (!AUTH_PATHS.some((path) => window.location.pathname.endsWith(path))) {
+        return;
+    }
+
+    let submitting = false;
+
+    function release() {
+        submitting = false;
+    }
+
+    function showNativeLoader() {
+        const webkitHandlers = window.webkit && window.webkit.messageHandlers;
+        if (window.nativeLoader) {
+            window.nativeLoader.postMessage("show");
+        } else if (webkitHandlers && webkitHandlers.nativeLoader) {
+            webkitHandlers.nativeLoader.postMessage("show");
+        }
+    }
+
+    document.addEventListener(
+        "submit",
+        function (ev) {
+            if (submitting) {
+                ev.preventDefault();
+                return;
+            }
+            submitting = true;
+            showNativeLoader();
+            // A navigation that never commits fires no event, so the form can
+            // only free itself once no response can plausibly still arrive.
+            window.setTimeout(release, RELEASE_MS);
+        },
+        true
+    );
+
+    // Restored from the back/forward cache: the form is live again.
+    window.addEventListener("pageshow", release);
+})();
diff --git a/my_compassion/templates/my2_assets.xml b/my_compassion/templates/my2_assets.xml
index d929adc9a..3b297f54c 100644
--- a/my_compassion/templates/my2_assets.xml
+++ b/my_compassion/templates/my2_assets.xml
@@ -7,6 +7,7 @@
     <template id="my_compassion_assets" name="My Compassion 2.0 assets" inherit_id="website.assets_frontend">
         <xpath expr="." position="inside">
             <script type="text/javascript" src="/my_compassion/static/src/js/toast_notification.js" />
+            <script type="text/javascript" src="/my_compassion/static/src/js/my2_auth_submit_guard.js" />
             <script type="text/javascript" src="/my_compassion/static/src/js/toast_service.js" />
             <script type="text/javascript" src="/my_compassion/static/src/js/my2_child_letters.js" />
             <script type="text/javascript" src="/my_compassion/static/src/js/my2_donation_form.js" />

From 113a1316606d08cce72bab12dbfc6ea7ea0753f4 Mon Sep 17 00:00:00 2001
From: Daniel Gergely <dgergely@compassion.ch>
Date: Thu, 24 Sep 2026 14:41:18 +0200
Subject: [PATCH 2/2] [T3481] FIX: loading indicator added

---
 .../static/src/js/my2_auth_submit_guard.js          | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/my_compassion/static/src/js/my2_auth_submit_guard.js b/my_compassion/static/src/js/my2_auth_submit_guard.js
index 0b99f7575..400a72aff 100644
--- a/my_compassion/static/src/js/my2_auth_submit_guard.js
+++ b/my_compassion/static/src/js/my2_auth_submit_guard.js
@@ -10,10 +10,13 @@
         return;
     }
 
-    let submitting = false;
+    let pending = null;
 
     function release() {
-        submitting = false;
+        if (pending) {
+            pending.querySelectorAll("button").forEach((button) => button.classList.remove("disabled"));
+            pending = null;
+        }
     }
 
     function showNativeLoader() {
@@ -28,11 +31,13 @@
     document.addEventListener(
         "submit",
         function (ev) {
-            if (submitting) {
+            if (pending) {
                 ev.preventDefault();
                 return;
             }
-            submitting = true;
+            pending = ev.target;
+            // Bootstrap dims a .disabled button and stops it taking taps.
+            pending.querySelectorAll("button").forEach((button) => button.classList.add("disabled"));
             showNativeLoader();
             // A navigation that never commits fires no event, so the form can
             // only free itself once no response can plausibly still arrive.