# Buggy code
def remove_from_shelf(shelf_id, book_id):
    xhr = request.headers.get("X-Requested-With") == "XMLHttpRequest"
    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
    if shelf is None:
        log.error("Invalid shelf specified: %s", shelf_id)
        if not xhr:
            return redirect(url_for("web.index"))
        return "Invalid shelf specified", 400

    # if shelf is public and use is allowed to edit shelfs, or if shelf is private and user is owner
    # allow editing shelfs
    # result   shelf public   user allowed    user owner
    #   false        1             0             x
    #   true         1             1             x
    #   true         0             x             1
    #   false        0             x             0

    if (not shelf.is_public and shelf.user_id == int(current_user.id)) or (
        shelf.is_public and current_user.role_edit_shelfs()
    ):
        book_shelf = (
            ub.session.query(ub.BookShelf)
            .filter(ub.BookShelf.shelf == shelf_id, ub.BookShelf.book_id == book_id)
            .first()
        )

        if book_shelf is None:
            log.error("Book %s already removed from %s", book_id, shelf)
            if not xhr:
                return redirect(url_for("web.index"))
            return "Book already removed from shelf", 410

        ub.session.delete(book_shelf)
        ub.session.commit()

        if not xhr:
            flash(
                _("Book has been removed from shelf: %(sname)s", sname=shelf.name),
                category="success",
            )
            return redirect(request.environ["HTTP_REFERER"])
        return "", 204
    else:
        log.error("User %s not allowed to remove a book from %s", current_user, shelf)
        if not xhr:
            flash(
                _(
                    "Sorry you are not allowed to remove a book from this shelf: %(sname)s",
                    sname=shelf.name,
                ),
                category="error",
            )
            return redirect(url_for("web.index"))
        return (
            "Sorry you are not allowed to remove a book from this shelf: %s"
            % shelf.name,
            403,
        )


# Traceback (KeyError)
Internal Server Error
500 Internal Server Error: The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.
Traceback (most recent call last):
File "/usr/local/lib/python3.6/dist-packages/flask/app.py", line 2446, in wsgi_app
response = self.full_dispatch_request()
File "/usr/local/lib/python3.6/dist-packages/flask/app.py", line 1951, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/usr/local/lib/python3.6/dist-packages/flask/app.py", line 1820, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/usr/local/lib/python3.6/dist-packages/flask/_compat.py", line 39, in reraise
raise value
File "/usr/local/lib/python3.6/dist-packages/flask/app.py", line 1949, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/local/lib/python3.6/dist-packages/flask/app.py", line 1935, in dispatch_request
return self.view_functions[rule.endpoint](**req.view_args)
File "/usr/local/lib/python3.6/dist-packages/flask_login/utils.py", line 261, in decorated_view
return func(*args, **kwargs)
File "/app/calibre-web/cps/web.py", line 217, in inner
return f(*args, **kwargs)
File "/app/calibre-web/cps/web.py", line 1071, in send_to_kindle
return redirect(request.environ["HTTP_REFERER"])
KeyError: 'HTTP_REFERER'

# Fixed code
def remove_from_shelf(shelf_id, book_id):
    xhr = request.headers.get("X-Requested-With") == "XMLHttpRequest"
    shelf = ub.session.query(ub.Shelf).filter(ub.Shelf.id == shelf_id).first()
    if shelf is None:
        log.error("Invalid shelf specified: %s", shelf_id)
        if not xhr:
            return redirect(url_for("web.index"))
        return "Invalid shelf specified", 400

    # if shelf is public and use is allowed to edit shelfs, or if shelf is private and user is owner
    # allow editing shelfs
    # result   shelf public   user allowed    user owner
    #   false        1             0             x
    #   true         1             1             x
    #   true         0             x             1
    #   false        0             x             0

    if (not shelf.is_public and shelf.user_id == int(current_user.id)) or (
        shelf.is_public and current_user.role_edit_shelfs()
    ):
        book_shelf = (
            ub.session.query(ub.BookShelf)
            .filter(ub.BookShelf.shelf == shelf_id, ub.BookShelf.book_id == book_id)
            .first()
        )

        if book_shelf is None:
            log.error("Book %s already removed from %s", book_id, shelf)
            if not xhr:
                return redirect(url_for("web.index"))
            return "Book already removed from shelf", 410

        ub.session.delete(book_shelf)
        ub.session.commit()

        if not xhr:
            flash(
                _("Book has been removed from shelf: %(sname)s", sname=shelf.name),
                category="success",
            )
            if "HTTP_REFERER" in request.environ:
                return redirect(request.environ["HTTP_REFERER"])
            else:
                return redirect(url_for("web.index"))
        return "", 204
    else:
        log.error("User %s not allowed to remove a book from %s", current_user, shelf)
        if not xhr:
            flash(
                _(
                    "Sorry you are not allowed to remove a book from this shelf: %(sname)s",
                    sname=shelf.name,
                ),
                category="error",
            )
            return redirect(url_for("web.index"))
        return (
            "Sorry you are not allowed to remove a book from this shelf: %s"
            % shelf.name,
            403,
        )