From 7f0573e917227686d2cc127be1364e2908740807 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Thu, 19 Jan 2023 16:00:59 +0100 Subject: [PATCH] Enforce POST method for account delete view --- modoboa/admin/views/identity.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modoboa/admin/views/identity.py b/modoboa/admin/views/identity.py index b274a02c4..eb6643e2f 100644 --- a/modoboa/admin/views/identity.py +++ b/modoboa/admin/views/identity.py @@ -11,6 +11,7 @@ from django.template.loader import render_to_string from django.utils.translation import ugettext as _, ungettext from django.views import generic from django.views.decorators.csrf import ensure_csrf_cookie +from django.views.decorators.http import require_http_methods from modoboa.core.models import User from modoboa.lib.exceptions import BadRequest, PermDeniedException @@ -185,6 +186,7 @@ def editaccount(request, pk): @login_required @permission_required("core.delete_user") +@require_http_methods(["POST"]) def delaccount(request, pk): User.objects.get(pk=pk).delete() return render_to_json_response(