From b0f54600dfc57f37a3fcbd2f3b40f3d2ef0b47f6 Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Fri, 10 May 2013 10:53:50 +0200
Subject: [PATCH] Also protect the forward definition form.

see #240
---
 .../templates/userprefs/forward.html          |  2 +-
 modoboa/userprefs/views.py                    | 19 +++++++++----------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/modoboa/userprefs/templates/userprefs/forward.html b/modoboa/userprefs/templates/userprefs/forward.html
index 895a2ef52..b0b607e14 100644
--- a/modoboa/userprefs/templates/userprefs/forward.html
+++ b/modoboa/userprefs/templates/userprefs/forward.html
@@ -2,7 +2,7 @@
 <h2>{% trans "Forward" %} <small>{% trans "Automatically forward emails to another address" %}</small></h2>
 <hr>
 <form class="form-horizontal" method="POST" action="{% url 'modoboa.userprefs.views.forward' %}" 
-      id="uprefs_form">
+      id="uprefs_form">{% csrf_token %}
   {% render_form form %}
   <div class="form-actions">
     <button type="submit" class="btn btn-primary" id="update" name="update">{% trans 'Update' %}</button>
diff --git a/modoboa/userprefs/views.py b/modoboa/userprefs/views.py
index 1895f70f1..9ecbf7533 100644
--- a/modoboa/userprefs/views.py
+++ b/modoboa/userprefs/views.py
@@ -1,6 +1,5 @@
 # coding: utf-8
 from django.shortcuts import render
-from django.template.loader import render_to_string
 from django.contrib.auth.decorators import login_required, user_passes_test
 from django.utils.translation import ugettext as _
 from modoboa.lib import parameters, events
@@ -50,10 +49,10 @@ def forward(request, tplname='userprefs/forward.html'):
                 error = str(e)
 
         return ajax_simple_response(dict(
-                status="ko",
-                errors=form.errors,
-                respmsg=error
-                ))
+            status="ko",
+            errors=form.errors,
+            respmsg=error
+        ))
 
     form = ForwardForm()
     if al is not None:
@@ -65,11 +64,11 @@ def forward(request, tplname='userprefs/forward.html'):
         else:
             form.fields["keepcopies"].initial = True
     return ajax_simple_response({
-            "status" : "ok",
-            "content" : render_to_string(tplname, {
-                    "form" : form
-                    })
-            })
+        "status": "ok",
+        "content": _render_to_string(request, tplname, {
+            "form": form
+        })
+    })
 
 @login_required
 def profile(request, tplname='userprefs/profile.html'):