From ac34dfa0bc65e2efeb9575d3cd42c4696d31bb1b Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Wed, 21 Oct 2015 00:03:56 +0200 Subject: [PATCH] luci-app-radicale: protect start/stop actions with csrf token Signed-off-by: Jo-Philipp Wich --- applications/luci-app-radicale/luasrc/controller/radicale.lua | 2 +- applications/luci-app-radicale/luasrc/view/radicale/btn_startstop.htm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/applications/luci-app-radicale/luasrc/controller/radicale.lua b/applications/luci-app-radicale/luasrc/controller/radicale.lua index d384b00d9..35f5a83a0 100644 --- a/applications/luci-app-radicale/luasrc/controller/radicale.lua +++ b/applications/luci-app-radicale/luasrc/controller/radicale.lua @@ -15,7 +15,7 @@ function index() entry( {"admin", "services", "radicale"}, alias("admin", "services", "radicale", "edit"), _("CalDAV/CardDAV"), 58) entry( {"admin", "services", "radicale", "edit"}, cbi("radicale") ).leaf = true entry( {"admin", "services", "radicale", "logview"}, call("_logread") ).leaf = true - entry( {"admin", "services", "radicale", "startstop"}, call("_startstop") ).leaf = true + entry( {"admin", "services", "radicale", "startstop"}, post("_startstop") ).leaf = true entry( {"admin", "services", "radicale", "status"}, call("_status") ).leaf = true end diff --git a/applications/luci-app-radicale/luasrc/view/radicale/btn_startstop.htm b/applications/luci-app-radicale/luasrc/view/radicale/btn_startstop.htm index b34627536..dbf4dddbc 100644 --- a/applications/luci-app-radicale/luasrc/view/radicale/btn_startstop.htm +++ b/applications/luci-app-radicale/luasrc/view/radicale/btn_startstop.htm @@ -21,7 +21,7 @@ function onclick_startstop(id) { // do start/stop var btnXHR = new XHR(); - btnXHR.get('<%=url('admin/services/radicale/startstop')%>', null, + btnXHR.post('<%=url('admin/services/radicale/startstop')%>', { token: '<%=token%>' }, function(x) { _data2elements(x); } ); } -- 2.11.0