Also protect the forward definition form.

see #240

modoboa/userprefs/templates/userprefs/forward.html

@@ -2,7 +2,7 @@
 <h2>{% trans "Forward" %} <small>{% trans "Automatically forward emails to another address" %}</small></h2>
 <hr>
 <form class="form-horizontal" method="POST" action="{% url 'modoboa.userprefs.views.forward' %}" 
-      id="uprefs_form">
+      id="uprefs_form">{% csrf_token %}
   {% render_form form %}
   <div class="form-actions">
     <button type="submit" class="btn btn-primary" id="update" name="update">{% trans 'Update' %}</button>

modoboa/userprefs/views.py

@@ -1,6 +1,5 @@
 # coding: utf-8
 from django.shortcuts import render
-from django.template.loader import render_to_string
 from django.contrib.auth.decorators import login_required, user_passes_test
 from django.utils.translation import ugettext as _
 from modoboa.lib import parameters, events
@@ -50,10 +49,10 @@ def forward(request, tplname='userprefs/forward.html'):
                 error = str(e)
 
         return ajax_simple_response(dict(
-                status="ko",
-                errors=form.errors,
-                respmsg=error
-                ))
+            status="ko",
+            errors=form.errors,
+            respmsg=error
+        ))
 
     form = ForwardForm()
     if al is not None:
@@ -65,11 +64,11 @@ def forward(request, tplname='userprefs/forward.html'):
         else:
             form.fields["keepcopies"].initial = True
     return ajax_simple_response({
-            "status" : "ok",
-            "content" : render_to_string(tplname, {
-                    "form" : form
-                    })
-            })
+        "status": "ok",
+        "content": _render_to_string(request, tplname, {
+            "form": form
+        })
+    })
 
 @login_required
 def profile(request, tplname='userprefs/profile.html'):