Use CSRF protection

boards/views/all_threads.py

@@ -1,3 +1,4 b''
+from dbus.decorators import method
 from django.core.urlresolvers import reverse
 from django.core.files import File
 from django.core.files.temp import NamedTemporaryFile
@@ -6,6 +7,8 b' from django.db import transaction'
 from django.http import Http404
 from django.shortcuts import render, redirect
 import requests
+from django.utils.decorators import method_decorator
+from django.views.decorators.csrf import csrf_protect
 
 from boards import utils, settings
 from boards.abstracts.paginator import get_paginator
@@ -43,6 +46,7 b' class AllThreadsView(PostMixin, FileUplo'
         self.settings_manager = None
         super(AllThreadsView, self).__init__()
 
+    @method_decorator(csrf_protect)
     def get(self, request, form: ThreadForm=None):
         page = request.GET.get('page', DEFAULT_PAGE)
 
@@ -81,6 +85,7 b' class AllThreadsView(PostMixin, FileUplo'
 
         return render(request, TEMPLATE, params)
 
+    @method_decorator(csrf_protect)
     def post(self, request):
         form = ThreadForm(request.POST, request.FILES,
                           error_class=PlainErrorList)

boards/views/api.py

@@ -7,6 +7,9 b' from django.db.models import Count'
 from django.http import HttpResponse
 from django.shortcuts import get_object_or_404
 from django.core import serializers
+from django.template.context_processors import csrf
+from django.views.decorators.csrf import csrf_protect
+
 from boards.abstracts.settingsmanager import get_settings_manager,\
         FAV_THREAD_NO_UPDATES
 
@@ -75,6 +78,7 b' def api_get_threaddiff(request):'
     return HttpResponse(content=json.dumps(json_data))
 
 
+@csrf_protect
 def api_add_post(request, opening_post_id):
     """
     Adds a post and return the JSON response for it

boards/views/thread/thread.py

@@ -4,6 +4,9 b' from django.core.exceptions import Objec'
 from django.core.urlresolvers import reverse
 from django.http import Http404
 from django.shortcuts import get_object_or_404, render, redirect
+from django.template.context_processors import csrf
+from django.utils.decorators import method_decorator
+from django.views.decorators.csrf import csrf_protect
 from django.views.generic.edit import FormMixin
 from django.utils import timezone
 from django.utils.dateformat import format
@@ -39,6 +42,7 b" FORM_THREADS = 'threads'"
 
 class ThreadView(BaseBoardView, PostMixin, FormMixin, DispatcherMixin):
 
+    @method_decorator(csrf_protect)
     def get(self, request, post_id, form: PostForm=None):
         try:
             opening_post = Post.objects.get(id=post_id)
@@ -85,6 +89,7 b' class ThreadView(BaseBoardView, PostMixi'
 
         return render(request, self.get_template(), params)
 
+    @method_decorator(csrf_protect)
     def post(self, request, post_id):
         opening_post = get_object_or_404(Post, id=post_id)
 

neboard/settings.py

@@ -106,6 +106,7 b' TEMPLATES = [{'
             ]),
         ],
         'context_processors': [
+            'django.template.context_processors.csrf',
             'django.core.context_processors.media',
             'django.core.context_processors.static',
             'django.core.context_processors.request',