tests/admin_pages/test_settings.py

@@ -339,6 +339,11 @@ def test_settings_export_import(pub):
     # check a warning is displayed if there's some content already
     resp = app.get('/backoffice/settings/import')
     assert 'This site has existing' in resp.text
+    # check a confirmation is required
+    assert resp.form['submit'].attrs['data-ask-for-confirmation']
+    resp = resp.form.submit('submit')
+    # check a checkbox is required
+    assert resp.pyquery('[data-widget-name="confirm"].widget-with-error')
 
     # check an error is displayed if such an import is then used and roles are
     # missing.
@@ -362,6 +367,7 @@ def test_settings_export_import(pub):
     zip_content = io.BytesIO(resp.body)
     resp = app.get('/backoffice/settings/import')
     resp.form['file'] = Upload('export.wcs', zip_content.getvalue())
+    resp.form['confirm'].checked = True
     resp = resp.form.submit('submit')
     assert 'Unknown referenced objects [Unknown fields blocks: unknown]' in resp
 

wcs/admin/settings.py

@@ -50,6 +50,7 @@ from wcs.qommon.form import (
     ComputedExpressionWidget,
     FileWidget,
     Form,
+    HtmlWidget,
     IntWidget,
     MapWidget,
     PasswordWidget,
@@ -955,7 +956,22 @@ class SettingsDirectory(AccessControlled, Directory):
     def p_import(self):
         form = Form(enctype='multipart/form-data')
         form.add(FileWidget, 'file', title=_('File'), required=True)
-        form.add_submit('submit', _('Submit'))
+        has_content = bool(FormDef.count() or CardDef.count() or Workflow.count())
+        if has_content:
+            form.widgets.append(
+                HtmlWidget(
+                    '<div class="warningnotice"><p><strong>%s</strong></p>'
+                    % _(
+                        'This site has existing forms, cards or workflows, beware re-importing '
+                        'content is dangerous and will probably break existing data and configuration.'
+                    )
+                )
+            )
+            form.add(CheckboxWidget, 'confirm', title=_('Do it anyway'), required=True)
+            form.widgets.append(HtmlWidget('</div>'))
+            form.add_submit('submit', _('Submit'), attrs={'data-ask-for-confirmation': 'true'})
+        else:
+            form.add_submit('submit', _('Submit'))
         form.add_submit('cancel', _('Cancel'))
         if form.get_submit() == 'cancel':
             return redirect('.')
@@ -965,11 +981,6 @@ class SettingsDirectory(AccessControlled, Directory):
             get_response().set_title(_('Import'))
             r = TemplateIO(html=True)
             r += htmltext('<h2>%s</h2>') % _('Import')
-            if FormDef.count() or CardDef.count() or Workflow.count():
-                r += htmltext('<div class="warningnotice">%s</div>') % _(
-                    'This site has existing forms, cards or workflows, beware re-importing '
-                    'content is dangerous and will probably break existing data and configuration.'
-                )
             r += htmltext('<div class="section form-inner-container">')
             r += form.render()
             r += htmltext('</div>')