Fixed #28889 -- Prevented double submission of admin forms.

Added a JavaScript confirm() to catch double-submissions, when the
change form has already been submitted.

Thanks to Adam Johnson, Claude Paroz, Keryn Knight, and Thibaud Colas
for review.

1 files changed, 14 insertions, 0 deletions

diff --git a/django/contrib/admin/static/admin/js/change_form.js b/django/contrib/admin/static/admin/js/change_form.js
index 96a4c62ef4..0ba16efef9 100644
--- a/django/contrib/admin/static/admin/js/change_form.js
+++ b/django/contrib/admin/static/admin/js/change_form.js
@@ -1,9 +1,23 @@
+/*global gettext*/
 'use strict';
 {
     const inputTags = ['BUTTON', 'INPUT', 'SELECT', 'TEXTAREA'];
     const modelName = document.getElementById('django-admin-form-add-constants').dataset.modelName;
+    let submitted = false;
+
     if (modelName) {
         const form = document.getElementById(modelName + '_form');
+
+        form.addEventListener('submit', (event) => {
+            event.preventDefault();
+            if (submitted) {
+                const answer = window.confirm(gettext('You have already submitted this form. Are you sure you want to submit it again?'));
+                if (!answer) {return;}
+            };
+            event.target.submit();
+            submitted = true;
+        });
+
         for (const element of form.elements) {
             // HTMLElement.offsetParent returns null when the element is not
             // rendered.