Enforce POST methods for delete domain view.

Avoids CSRF vulnerability.

modoboa/admin/views/domain.py

@@ -15,6 +15,7 @@ from django.template.loader import render_to_string
 from django.urls import reverse
 from django.utils.translation import ugettext as _, ungettext
 from django.views import generic
+from django.views.decorators import require_http_methods
 from django.views.decorators.csrf import ensure_csrf_cookie
 
 from modoboa.core import signals as core_signals
@@ -230,6 +231,7 @@ def editdomain(request, dom_id):
 
 @login_required
 @permission_required("admin.delete_domain")
+@require_http_methods(["POST"])
 def deldomain(request, dom_id):
     keepdir = request.POST.get("keepdir", "false") == "true"
     try: