From a5473ae7f294ae2678b9d9e25a3c97cb56c62cb4 Mon Sep 17 00:00:00 2001
From: Sunil Mohan Adapa <sunil@medhas.org>
Date: Tue, 10 Feb 2015 14:00:46 +0530
Subject: [PATCH] upgrades: Require CSRF token for starting upgrade process

---
 plinth/modules/upgrades/templates/upgrades.html | 9 ++++++---
 plinth/modules/upgrades/upgrades.py             | 2 ++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/plinth/modules/upgrades/templates/upgrades.html b/plinth/modules/upgrades/templates/upgrades.html
index 29c6d7cd3..45f904c46 100644
--- a/plinth/modules/upgrades/templates/upgrades.html
+++ b/plinth/modules/upgrades/templates/upgrades.html
@@ -25,8 +25,11 @@
 <p>This will run unattended-upgrades, which will attempt to upgrade your system
 with the latest Debian packages. It may take a minute to complete.</p>
 
-<p><a class="btn btn-primary btn-lg" href="{% url 'upgrades:run' %}">
-  Upgrade now &raquo;
-</a></p>
+<form class="form" method="post" action="{% url 'upgrades:run' %}">
+  {% csrf_token %}
+
+  <input type="submit" class="btn btn-primary" value="Upgrade now &raquo;"/>
+
+</form>
 
 {% endblock %}
diff --git a/plinth/modules/upgrades/upgrades.py b/plinth/modules/upgrades/upgrades.py
index e000320af..90d11009d 100644
--- a/plinth/modules/upgrades/upgrades.py
+++ b/plinth/modules/upgrades/upgrades.py
@@ -24,6 +24,7 @@ from django.contrib import messages
 from django.contrib.auth.decorators import login_required
 from django.core.urlresolvers import reverse_lazy
 from django.template.response import TemplateResponse
+from django.views.decorators.http import require_POST
 from gettext import gettext as _
 
 from plinth import actions
@@ -54,6 +55,7 @@ def index(request):
 
 
 @login_required
+@require_POST
 @package.required('unattended-upgrades')
 def run(request):
     """Run upgrades and show the output page"""