From f23f7b8751bb36829fd2136dffadcfe1e702149a Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Wed, 21 Oct 2015 00:11:28 +0200
Subject: luci-app-upnp: protect lease delete call with csrf token

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
---
 applications/luci-app-upnp/luasrc/view/upnp_status.htm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'applications/luci-app-upnp/luasrc/view/upnp_status.htm')

diff --git a/applications/luci-app-upnp/luasrc/view/upnp_status.htm b/applications/luci-app-upnp/luasrc/view/upnp_status.htm
index ce735cf7b1..e358dcded3 100644
--- a/applications/luci-app-upnp/luasrc/view/upnp_status.htm
+++ b/applications/luci-app-upnp/luasrc/view/upnp_status.htm
@@ -1,6 +1,6 @@
 <script type="text/javascript">//<![CDATA[
 	function upnp_delete_fwd(idx) {
-		XHR.get('<%=url('admin/services/upnp/delete')%>/' + idx, null,
+		(new XHR()).post('<%=url('admin/services/upnp/delete')%>/' + idx, { token: '<%=token%>' },
 			function(x)
 			{
 				var tb = document.getElementById('upnp_status_table');
-- 
cgit v1.2.3