luci-app-upnp: protect lease delete call with csrf token

[project/luci.git] / applications / luci-app-upnp / luasrc / view / upnp_status.htm

diff --git a/applications/luci-app-upnp/luasrc/view/upnp_status.htm b/applications/luci-app-upnp/luasrc/view/upnp_status.htm
index ce735cf..e358dcd 100644 (file)
--- a/applications/luci-app-upnp/luasrc/view/upnp_status.htm
+++ b/applications/luci-app-upnp/luasrc/view/upnp_status.htm
@@ -1,6 +1,6 @@
 <script type="text/javascript">//<![CDATA[
        function upnp_delete_fwd(idx) {
-               XHR.get('<%=url('admin/services/upnp/delete')%>/' + idx, null,
+               (new XHR()).post('<%=url('admin/services/upnp/delete')%>/' + idx, { token: '<%=token%>' },
                        function(x)
                        {
                                var tb = document.getElementById('upnp_status_table');