diff mbox

[Branch,~linaro-validation/lava-scheduler/trunk] Rev 68: forbid GETs to the job_cancel view

Message ID 20110822030213.3663.3081.launchpad@ackee.canonical.com
State Accepted
Headers show

Commit Message

Michael-Doyle Hudson Aug. 22, 2011, 3:02 a.m. UTC 
------------------------------------------------------------
revno: 68
committer: Michael-Doyle Hudson <michael.hudson@linaro.org>
branch nick: trunk
timestamp: Mon 2011-08-22 15:01:17 +1200
message:
  forbid GETs to the job_cancel view
modified:
  lava_scheduler_app/views.py


--
lp:lava-scheduler
https://code.launchpad.net/~linaro-validation/lava-scheduler/trunk

You are subscribed to branch lp:lava-scheduler.
To unsubscribe from this branch go to https://code.launchpad.net/~linaro-validation/lava-scheduler/trunk/+edit-subscription
diff mbox

Patch

=== modified file 'lava_scheduler_app/views.py'
--- lava_scheduler_app/views.py	2011-08-19 03:32:49 +0000
+++ lava_scheduler_app/views.py	2011-08-22 03:01:17 +0000
@@ -1,11 +1,24 @@ 
 import os
 
-from django.http import HttpResponse, HttpResponseForbidden
+from django.http import (
+    HttpResponse,
+    HttpResponseForbidden,
+    HttpResponseNotAllowed,
+    )
 from django.template import RequestContext
 from django.shortcuts import redirect, render_to_response
 
 from lava_scheduler_app.models import Device, TestJob
 
+
+def post_only(func):
+    def decorated(request, *args, **kwargs):
+        if request.method != 'POST':
+            return HttpResponseNotAllowed('Only POST here')
+        return func(request, *args, **kwargs)
+    return decorated
+
+
 def index(request):
     return render_to_response(
         "lava_scheduler_app/index.html",
@@ -72,6 +85,7 @@ 
     return response
 
 
+@post_only
 def job_cancel(request, pk):
     job = TestJob.objects.get(pk=pk)
     if job.can_cancel(request.user):