From ada4a0ea98fbd8fa396cb601ace6c52f3857f5cc Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Tue, 6 Oct 2015 22:37:23 +0200
Subject: [PATCH] luci-base: switch to POST action for service reload

Switches the service reload calls to CSRF token protected POST action.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
---
 modules/luci-base/luasrc/controller/admin/servicectl.lua | 2 +-
 modules/luci-base/luasrc/view/cbi/apply_xhr.htm          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/luci-base/luasrc/controller/admin/servicectl.lua b/modules/luci-base/luasrc/controller/admin/servicectl.lua
index 5b855cb24b..1d73eb4ecc 100644
--- a/modules/luci-base/luasrc/controller/admin/servicectl.lua
+++ b/modules/luci-base/luasrc/controller/admin/servicectl.lua
@@ -6,7 +6,7 @@ module("luci.controller.admin.servicectl", package.seeall)
 function index()
 	entry({"servicectl"}, alias("servicectl", "status")).sysauth = "root"
 	entry({"servicectl", "status"}, call("action_status")).leaf = true
-	entry({"servicectl", "restart"}, call("action_restart")).leaf = true
+	entry({"servicectl", "restart"}, post("action_restart")).leaf = true
 end
 
 function action_status()
diff --git a/modules/luci-base/luasrc/view/cbi/apply_xhr.htm b/modules/luci-base/luasrc/view/cbi/apply_xhr.htm
index 1814c9393b..6f63ba86be 100644
--- a/modules/luci-base/luasrc/view/cbi/apply_xhr.htm
+++ b/modules/luci-base/luasrc/view/cbi/apply_xhr.htm
@@ -4,7 +4,7 @@
 	<script type="text/javascript">//<![CDATA[
 		var apply_xhr = new XHR();
 
-		apply_xhr.get('<%=luci.dispatcher.build_url("servicectl", "restart", table.concat(configs, ","))%>', null,
+		apply_xhr.post('<%=luci.dispatcher.build_url("servicectl", "restart", table.concat(configs, ","))%>', { token: '<%=token%>' },
 			function() {
 				var checkfinish = function() {
 					apply_xhr.get('<%=luci.dispatcher.build_url("servicectl", "status")%>', null,
-- 
2.30.2