This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit bc0c96d0dd64a19752ae59505819989a9d30c445 Author: Dave Brondsema <[email protected]> AuthorDate: Tue May 5 13:34:41 2026 -0400 [#8603] add @require_post to a few endpoints --- Allura/allura/controllers/discuss.py | 2 ++ Allura/allura/lib/widgets/discuss.py | 7 +++++++ ForgeShortUrl/forgeshorturl/main.py | 2 ++ 3 files changed, 11 insertions(+) diff --git a/Allura/allura/controllers/discuss.py b/Allura/allura/controllers/discuss.py index c890696e7..d4199eef0 100644 --- a/Allura/allura/controllers/discuss.py +++ b/Allura/allura/controllers/discuss.py @@ -103,6 +103,7 @@ def error_handler(self, *args, **kwargs): @h.vardec @expose() + @require_post() @validate(pass_validator, error_handler=error_handler) def subscribe(self, **kw): threads = kw.pop('threads', []) @@ -245,6 +246,7 @@ def tag(self, labels, **kw): redirect(six.ensure_text(request.referer or '/')) @expose() + @require_post() def flag_as_spam(self, **kw): require_access(self.thread, 'moderate') self.thread.spam() diff --git a/Allura/allura/lib/widgets/discuss.py b/Allura/allura/lib/widgets/discuss.py index 1b8f440e6..fe7a38749 100644 --- a/Allura/allura/lib/widgets/discuss.py +++ b/Allura/allura/lib/widgets/discuss.py @@ -426,6 +426,13 @@ def resources(self): if (thread_spam.length) { if (allow_moderate.length) { thread_spam[0].style.display='block'; + thread_spam.click(function (e) { + e.preventDefault(); + var form = $('<form method="post" action="' + this.href + '"></form>'); + form.append('<input type="hidden" name="_csrf_token" value="' + $.cookie('_csrf_token') + '">'); + $('body').append(form); + form.submit(); + }); } } }); diff --git a/ForgeShortUrl/forgeshorturl/main.py b/ForgeShortUrl/forgeshorturl/main.py index adae9518d..72dbaf277 100644 --- a/ForgeShortUrl/forgeshorturl/main.py +++ b/ForgeShortUrl/forgeshorturl/main.py @@ -23,6 +23,7 @@ from allura.app import Application, SitemapEntry, DefaultAdminController from allura import model as M from allura.lib.security import require_access, has_access +from allura.lib.decorators import require_post from allura.lib import helpers as h from allura.lib import validators as v from allura.lib.search import search_app @@ -207,6 +208,7 @@ def index(self, **kw): @without_trailing_slash @expose('json:') + @require_post() def remove(self, shorturl, **kw): require_access(self.app, 'update') ShortUrl.query.remove({
