From a3845de282299bd805d6455789bc6531bde861be Mon Sep 17 00:00:00 2001
From: Christian Weiske <cweiske@cweiske.de>
Date: Fri, 30 Mar 2012 07:54:14 +0200
Subject: [PATCH] forking only possible with POST requests now

---
 data/templates/display.htm | 4 +++-
 www/fork.php               | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/data/templates/display.htm b/data/templates/display.htm
index 0b95912..ca52775 100644
--- a/data/templates/display.htm
+++ b/data/templates/display.htm
@@ -17,7 +17,9 @@
   <h3>Paste #{{repo.id}}</h3>
  </div>
  <div class="span4" style="text-align: right">
-  <a class="btn" href="{{repo.getLink('fork')}}"><i class="icon-share"></i> fork</a>
+  <form method="post" action="{{repo.getLink('fork')}}">
+    <button type="submit" class="btn"><i class="icon-share"></i> fork</button>
+  </form>
  </div>
 </div>
 
diff --git a/www/fork.php b/www/fork.php
index 6bec5f0..f6ec95a 100644
--- a/www/fork.php
+++ b/www/fork.php
@@ -4,6 +4,11 @@
  */
 namespace Phorkie;
 require_once 'www-header.php';
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    throw new Exception_Input('Forking only possible via POST');
+}
+
 $repo = new Repository();
 $repo->loadFromRequest();
 
-- 
2.30.2