allow only AJAX requests for post votes, otherwise it makes CSRF possible

[osqa.git] / forum / models / question.py

diff --git a/forum/models/question.py b/forum/models/question.py
index 136d3de78590cc3d2fbba2604ef09e412489b63b..6fae319e79088aeef1e9ccb5b625d11be12369c9 100644 (file)
--- a/forum/models/question.py
+++ b/forum/models/question.py
@@ -27,6 +27,9 @@ class Question(Node):
 
     @property
     def headline(self):
 
     @property
     def headline(self):

+        return self._headline()
+
+    def _headline(self):

         if self.nis.deleted:
             return _('[deleted] ') + self.title
 
         if self.nis.deleted:
             return _('[deleted] ') + self.title