Require POST for make_friend and remove_friend

[rails.git] / app / views / user / _contact.html.erb

diff --git a/app/views/user/_contact.html.erb b/app/views/user/_contact.html.erb
index 9bac0dc2d67bee754eeaafd0bb809d33e0be4590..2418ed24cdc10d18581f51747395eb4d7b419eaa 100644 (file)
--- a/app/views/user/_contact.html.erb
+++ b/app/views/user/_contact.html.erb
@@ -33,9 +33,9 @@
     <%= link_to t('user.view.send message'), :controller => 'message', :action => 'new', :display_name => contact.display_name %>
     |
     <% if @user.is_friends_with?(contact) %>
     <%= link_to t('user.view.send message'), :controller => 'message', :action => 'new', :display_name => contact.display_name %>
     |
     <% if @user.is_friends_with?(contact) %>

-      <%= link_to t('user.view.remove as friend'), :controller => 'user', :action => 'remove_friend', :display_name => contact.display_name, :referer => request.fullpath %>
+      <%= link_to t('user.view.remove as friend'), :controller => 'user', :action => 'remove_friend', :display_name => contact.display_name, :referer => request.fullpath, :method => :post %>

     <% else %>
     <% else %>

-      <%= link_to t('user.view.add as friend'), :controller => 'user', :action => 'make_friend', :display_name => contact.display_name, :referer => request.fullpath %>
+      <%= link_to t('user.view.add as friend'), :controller => 'user', :action => 'make_friend', :display_name => contact.display_name, :referer => request.fullpath, :method => :post %>

     <% end %>
   </td>
 </tr>
     <% end %>
   </td>
 </tr>