Corrected profile deletion

overlay_manager/main.py

@@ -273,22 +273,29 @@ async def activate_profile(profile_id: int = Form(...)):
         return RedirectResponse(url=f"/patch-manager/?error_msg=Failed to activate profile.", status_code=303)
 
 @app.post("/profile/delete")
-async def delete_profile(profile_id: int = Form(...)):
+async def delete_profile(profile_id: int = Form(...), password: str = Form(default="")):
     try:
         with get_db_connection() as conn:
-            prof = conn.execute("SELECT is_readonly, is_active, password FROM profiles WHERE id = ?").fetchone()
+            prof = conn.execute("SELECT is_readonly, is_active, password FROM profiles WHERE id = ?", (profile_id,)).fetchone()
             
             if prof:
                 if prof['is_readonly']:
                     msg = quote("Cannot delete a read-only profile.")
                     return RedirectResponse(url=f"/patch-manager/?error_msg={msg}", status_code=303)
-                if prof['password']:
-                    msg = quote("Cannot delete a locked profile. Unlock it first.")
-                    return RedirectResponse(url=f"/patch-manager/?error_msg={msg}", status_code=303)
                 if prof['is_active']:
                     msg = quote("Cannot delete the currently active profile. Switch to another first.")
                     return RedirectResponse(url=f"/patch-manager/?error_msg={msg}", status_code=303)
                 
+                if prof['password']:
+                    if not password.strip():
+                        msg = quote("Cannot delete a locked profile without a password.")
+                        return RedirectResponse(url=f"/patch-manager/?error_msg={msg}", status_code=303)
+                    
+                    hashed_pw = hash_password(password.strip())
+                    if prof['password'] != hashed_pw:
+                        msg = quote("Incorrect password. Profile not deleted.")
+                        return RedirectResponse(url=f"/patch-manager/?error_msg={msg}", status_code=303)
+                
             conn.execute("DELETE FROM profiles WHERE id = ?", (profile_id,))
             conn.commit()
         msg = quote("Profile deleted successfully.")

overlay_manager/templates/index.html

@@ -115,14 +115,22 @@
                                             </form>
                                         </li>
                                         
-                                        {% if not p.is_active and not p.is_readonly and not p.is_locked %}
-                                        <li><hr class="dropdown-divider"></li>
-                                        <li>
-                                            <form action="/patch-manager/profile/delete" method="post" class="m-0 p-0" onsubmit="return confirm('Delete this profile completely?');">
-                                                <input type="hidden" name="profile_id" value="{{ p.id }}">
-                                                <button type="submit" class="dropdown-item text-danger"><i class="bi bi-trash me-2"></i>Delete Profile</button>
-                                            </form>
-                                        </li>
+                                        {% if not p.is_active and not p.is_readonly %}
+                                            <li><hr class="dropdown-divider"></li>
+                                            {% if p.is_locked %}
+                                            <li>
+                                                <a class="dropdown-item text-danger" href="javascript:void(0)" onclick="openDeleteLockedModal({{ p.id }}, '{{ p.name|escape }}')">
+                                                    <i class="bi bi-trash me-2"></i>Delete Profile
+                                                </a>
+                                            </li>
+                                            {% else %}
+                                            <li>
+                                                <form action="/patch-manager/profile/delete" method="post" class="m-0 p-0" onsubmit="return confirm('Delete this profile completely?');">
+                                                    <input type="hidden" name="profile_id" value="{{ p.id }}">
+                                                    <button type="submit" class="dropdown-item text-danger"><i class="bi bi-trash me-2"></i>Delete Profile</button>
+                                                </form>
+                                            </li>
+                                            {% endif %}
                                         {% endif %}
                                     </ul>
                                 </div>
@@ -361,6 +369,31 @@
             </div>
         </div>
     </div>
+    
+    <div class="modal fade" id="deleteLockedModal" tabindex="-1" aria-hidden="true">
+        <div class="modal-dialog">
+            <div class="modal-content">
+                <form action="/patch-manager/profile/delete" method="post">
+                    <div class="modal-header bg-light">
+                        <h5 class="modal-title fw-bold text-danger"><i class="bi bi-trash me-2"></i>Delete Locked Profile</h5>
+                        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                    </div>
+                    <div class="modal-body p-4">
+                        <input type="hidden" name="profile_id" id="delete-locked-profile-id">
+                        <p>Enter the password to permanently delete <strong id="delete-locked-profile-name"></strong>.</p>
+                        <div class="mb-3">
+                            <label class="form-label text-muted small fw-bold">Password</label>
+                            <input type="password" class="form-control" name="password" required>
+                        </div>
+                    </div>
+                    <div class="modal-footer bg-light d-flex justify-content-between">
+                        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                        <button type="submit" class="btn btn-danger fw-bold"><i class="bi bi-trash me-1"></i>Delete Profile</button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </div>
 
     <footer class="py-3 bg-dark text-white-50 mt-auto">
         <div class="container-fluid px-4 d-flex justify-content-between">
@@ -395,6 +428,12 @@
             document.getElementById('unlock-profile-name').innerText = profileName;
             new bootstrap.Modal(document.getElementById('unlockModal')).show();
         }
+        
+        function openDeleteLockedModal(profileId, profileName) {
+            document.getElementById('delete-locked-profile-id').value = profileId;
+            document.getElementById('delete-locked-profile-name').innerText = profileName;
+            new bootstrap.Modal(document.getElementById('deleteLockedModal')).show();
+        }
     </script>
 </body>
 </html>