network: CSRF check for (de)activating connections

Fixes issue #127
Network manager: fix CSRF when activating/deactivating network connections
https://github.com/freedombox/Plinth/issues/127

plinth/modules/networks/networks.py

@@ -19,6 +19,7 @@ from django.contrib import messages
 from django.core.urlresolvers import reverse_lazy
 from django.shortcuts import redirect
 from django.template.response import TemplateResponse
+from django.views.decorators.http import require_POST
 from gettext import gettext as _
 from logging import Logger
 
@@ -167,6 +168,7 @@ def edit(request, uuid):
                                  'form': form})
 
 
+@require_POST
 def activate(request, uuid):
     """Activate the connection."""
     try:
@@ -184,6 +186,7 @@ def activate(request, uuid):
     return redirect(reverse_lazy('networks:index'))
 
 
+@require_POST
 def deactivate(request, uuid):
     """Deactivate the connection."""
     try:

plinth/modules/networks/templates/connections_list.html

@@ -26,13 +26,21 @@
         display: inline-block;
         width: 40%;
     }
+
     .connection-type-label {
         display: inline-block;
         width: 20%;
     }
+
     .list-group-item .btn {
         margin: -5px 0;
     }
+
+    .dropdown-menu .btn {
+        background: none;
+        width: 100%;
+        text-align: left;
+    }
   </style>
 {% endblock %}
 
@@ -67,9 +75,12 @@
                 </button>
                 <ul class="dropdown-menu" role="menu">
                   <li>
-                  <a href="{% url 'networks:deactivate' connection.uuid %}">
+                    <form name="toggle_form" id="toggle_form" class="form" method="post"
-                    Deactivate
+                          action="{% url 'networks:deactivate' connection.uuid %}">
-                  </a>
+                      {% csrf_token %}
+
+                      <button type="submit" class="btn">Deactivate</button>
+                    </form>
                   </li>
                 </ul>
               </div>
@@ -82,9 +93,12 @@
                 </button>
                 <ul class="dropdown-menu" role="menu">
                   <li>
-                  <a href="{% url 'networks:activate' connection.uuid %}">
+                    <form name="toggle_form" id="toggle_form" class="form" method="post"
-                    Activate
+                          action="{% url 'networks:activate' connection.uuid %}">
-                  </a>
+                      {% csrf_token %}
+
+                      <button type="submit" class="btn">Activate</button>
+                    </form>
                   </li>
                 </ul>
               </div>