allow only AJAX requests for post votes, otherwise it makes CSRF possible

[osqa.git] / forum / views / users.py

diff --git a/forum/views/users.py b/forum/views/users.py
index bc0abc3d2fed661991e0c81ccae51525163ab9bf..0777005e820e89d7752ddbeaa86b33bb6bc5ba8b 100644 (file)
--- a/forum/views/users.py
+++ b/forum/views/users.py
@@ -33,13 +33,13 @@ class UserReputationSort(pagination.SimpleSort):
         return objects.order_by('-is_active', self.order_by)\r
 \r
 class UserListPaginatorContext(pagination.PaginatorContext):\r
-    def __init__(self, pagesizes=(20, 35, 60)):\r
+    def __init__(self, pagesizes=(20, 35, 60), default_pagesize=35):\r
         super (UserListPaginatorContext, self).__init__('USERS_LIST', sort_methods=(\r
             (_('reputation'), UserReputationSort(_('reputation'), '-reputation', _("sorted by reputation"))),\r
             (_('newest'), pagination.SimpleSort(_('recent'), '-date_joined', _("newest members"))),\r
             (_('last'), pagination.SimpleSort(_('oldest'), 'date_joined', _("oldest members"))),\r
             (_('name'), pagination.SimpleSort(_('by username'), 'username', _("sorted by username"))),\r
-        ), pagesizes=pagesizes)\r
+        ), pagesizes=pagesizes, default_pagesize=default_pagesize)\r
 \r
 class SubscriptionListPaginatorContext(pagination.PaginatorContext):\r
     def __init__(self):\r
@@ -131,7 +131,7 @@ def online_users(request):
     })\r
 \r
 \r
-def edit_user(request, id):\r
+def edit_user(request, id, slug):\r
     user = get_object_or_404(User, id=id)\r
     if not (request.user.is_superuser or request.user == user):\r
         return HttpResponseUnauthorized(request)\r
@@ -236,7 +236,7 @@ def suspend(request, id):
             return render_to_response('users/suspend_user.html')\r
 \r
     data = {\r
-        'bantype': request.POST.get('bantype', 'indefinetly').strip(),\r
+        'bantype': request.POST.get('bantype', 'Indefinitely').strip(),\r
         'publicmsg': request.POST.get('publicmsg', _('Bad behaviour')),\r
         'privatemsg': request.POST.get('privatemsg', None) or request.POST.get('publicmsg', ''),\r
         'suspended': user\r