Fixed CSRF issues in edit operations.

modoboa · Feb 27, 2023 · 5d886f3 · 5d886f3
1 parent 9021ac0
commit 5d886f3
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/modoboa/admin/views/domain.py b/modoboa/admin/views/domain.py
@@ -214,6 +214,7 @@ def newdomain(request):
 
 @login_required
 @permission_required("admin.view_domain")
+@require_http_methods(["POST"])
 @reversion.create_revision()
 def editdomain(request, dom_id):
     """Edit domain view."""

diff --git a/modoboa/admin/views/identity.py b/modoboa/admin/views/identity.py
@@ -167,6 +167,7 @@ def newaccount(request):
 
 @login_required
 @permission_required("core.change_user")
+@require_http_methods(["POST"])
 @reversion.create_revision()
 def editaccount(request, pk):
     account = User.objects.get(pk=pk)