From: Jo-Philipp Wich <jow@openwrt.org>
Date: Tue, 20 Oct 2015 21:58:01 +0000 (+0200)
Subject: luci-app-ddns: protect start/stop actions with csrf token
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=b9ed03c5a9a52c17b30f3fb61b81ce1c2ee0ea6e;p=project%2Fluci.git

luci-app-ddns: protect start/stop actions with csrf token

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
---

diff --git a/applications/luci-app-ddns/luasrc/controller/ddns.lua b/applications/luci-app-ddns/luasrc/controller/ddns.lua
index 946dfefbc8..4fbd3c3fcf 100644
--- a/applications/luci-app-ddns/luasrc/controller/ddns.lua
+++ b/applications/luci-app-ddns/luasrc/controller/ddns.lua
@@ -38,7 +38,7 @@ function index()
 		{hideapplybtn=true, hidesavebtn=true, hideresetbtn=true}), nil ).leaf = true
 	entry( {"admin", "services", "ddns", "global"}, cbi("ddns/global"), nil ).leaf = true
 	entry( {"admin", "services", "ddns", "logview"}, call("logread") ).leaf = true
-	entry( {"admin", "services", "ddns", "startstop"}, call("startstop") ).leaf = true
+	entry( {"admin", "services", "ddns", "startstop"}, post("startstop") ).leaf = true
 	entry( {"admin", "services", "ddns", "status"}, call("status") ).leaf = true
 end
 
diff --git a/applications/luci-app-ddns/luasrc/view/ddns/overview_status.htm b/applications/luci-app-ddns/luasrc/view/ddns/overview_status.htm
index 5464812223..b6d4ebb9fd 100644
--- a/applications/luci-app-ddns/luasrc/view/ddns/overview_status.htm
+++ b/applications/luci-app-ddns/luasrc/view/ddns/overview_status.htm
@@ -136,7 +136,7 @@
 
 		// do start/stop
 		var btnXHR = new XHR();
-		btnXHR.get('<%=url('admin/services/ddns/startstop')%>/' + section + '/' + cbx.checked, null,
+		btnXHR.post('<%=url('admin/services/ddns/startstop')%>/' + section + '/' + cbx.checked, { token: '<%=token%>' },
 			function(x, data) {
 				if (x.responseText == "_uncommitted_") {
 					// we need a trick to display Ampersand "&" in stead of "&#38;" or "&amp;"