The endpoint returns an HTTP 302 redirect to the records page (/registros) with a flash message.Status Code: 302 FoundLocation: /registrosFlash Message: Registro eliminado correctamente (category: ok)
@app.route("/eliminar/<id>")def eliminar(id): rows = read_csv() filtered = [r for r in rows if r["id"] != id] deleted = [r for r in rows if r["id"] == id] if deleted: img = deleted[0]["imagen"] img_path = os.path.join(UPLOADS_DIR, img) if os.path.exists(img_path): os.remove(img_path) write_csv(filtered) flash("Registro eliminado correctamente", "ok") return redirect(url_for("registros"))
# Delete record with ID 5curl http://localhost:5000/eliminar/5
import requestsrecord_id = "5"url = f"http://localhost:5000/eliminar/{record_id}"response = requests.get(url)# Response will be a redirectprint(f"Status: {response.status_code}")print(f"Redirected to: {response.url}")# If you want to follow redirects automatically:response = requests.get(url, allow_redirects=True)print("Final page:", response.url)
<!-- Delete button in a table row --><a href="/eliminar/{{ record.id }}" onclick="return confirm('¿Eliminar este registro?')"> Eliminar</a><!-- Or as a button --><form action="/eliminar/{{ record.id }}" method="GET" style="display:inline;"> <button type="submit" onclick="return confirm('¿Eliminar este registro?')"> Eliminar </button></form>
No Confirmation: This endpoint does not ask for confirmation. Deletion is immediate and irreversible. Implement client-side confirmation dialogs for safety.
ID Comparison: The ID comparison uses string matching (r["id"] != id). IDs are treated as strings, not integers.
Missing Images: If the associated image file doesn’t exist (already deleted or moved), the endpoint still succeeds and removes the record from the CSV.
Non-existent IDs: If the specified ID doesn’t exist, the endpoint still returns success without any error. No records are deleted, and no error message is shown.
No Authentication: Any user can delete any record by knowing its ID. Implement authentication and authorization for production use.
ID Enumeration: Sequential IDs make it easy to enumerate and delete all records. Consider using UUIDs for production.
Directory Traversal: The current implementation is safe because the image filename comes from the database, not user input. However, ensure validation if this changes.
