Force DELETE method for remove permission view.

Avoids CSRF issue.

modoboa/admin/templates/admin/domain_detail.html

@@ -125,7 +125,7 @@
                 {% trans "Show key" %}
               </button>
               <button data-toggle="modal" class="btn btn-default btn-xs" data-target="#dkim_regenerate_dialog"><span class="fa fa-refresh"></span></button>
-              
+
               <div class="modal fade" id="dkim_regenerate_dialog" tabindex="-1" role="dialog" aria-labelledby="dkim_regenerate_dialog" aria-hidden="true">
                 <div class="modal-dialog" role="document">
                     <div class="modal-content">
@@ -206,6 +206,16 @@
               window.location.reload();
           });
       });
+      $('a[name="removeperm"]').click(function (evt) {
+          evt.preventDefault();
+          var $this = $(this);
+          $.ajax({
+              url: $this.attr('href'),
+              method: 'DELETE'
+          }).done(function () {
+              window.location.reload();
+          });
+      });
   });
   function copy(id) {
     navigator.clipboard.writeText(document.getElementById(id).textContent);

modoboa/admin/views/identity.py

@@ -196,6 +196,7 @@ def delaccount(request, pk):
 
 @login_required
 @permission_required("admin.add_domain")
+@require_http_methods(["DELETE"])
 def remove_permission(request):
     domid = request.GET.get("domid", None)
     daid = request.GET.get("daid", None)