luci-base: switch to POST action for service reload

Switches the service reload calls to CSRF token protected POST action.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

diff --git a/modules/luci-base/luasrc/controller/admin/servicectl.lua b/modules/luci-base/luasrc/controller/admin/servicectl.lua
index 5b855cb..1d73eb4 100644 (file)
--- a/modules/luci-base/luasrc/controller/admin/servicectl.lua
+++ b/modules/luci-base/luasrc/controller/admin/servicectl.lua
@@ -6,7 +6,7 @@ module("luci.controller.admin.servicectl", package.seeall)
 function index()
        entry({"servicectl"}, alias("servicectl", "status")).sysauth = "root"
        entry({"servicectl", "status"}, call("action_status")).leaf = true
-       entry({"servicectl", "restart"}, call("action_restart")).leaf = true
+       entry({"servicectl", "restart"}, post("action_restart")).leaf = true
 end
 
 function action_status()

diff --git a/modules/luci-base/luasrc/view/cbi/apply_xhr.htm b/modules/luci-base/luasrc/view/cbi/apply_xhr.htm
index 1814c93..6f63ba8 100644 (file)
--- a/modules/luci-base/luasrc/view/cbi/apply_xhr.htm
+++ b/modules/luci-base/luasrc/view/cbi/apply_xhr.htm
@@ -4,7 +4,7 @@
        <script type="text/javascript">//<![CDATA[
                var apply_xhr = new XHR();
 
-               apply_xhr.get('<%=luci.dispatcher.build_url("servicectl", "restart", table.concat(configs, ","))%>', null,
+               apply_xhr.post('<%=luci.dispatcher.build_url("servicectl", "restart", table.concat(configs, ","))%>', { token: '<%=token%>' },
                        function() {
                                var checkfinish = function() {
                                        apply_xhr.get('<%=luci.dispatcher.build_url("servicectl", "status")%>', null,