[bug 572880] Require POST when submitting forum reply

apps/forums/tests/test_views.py

@@ -34,6 +34,14 @@ def test_reply_without_post_permission(self):
                             args=['restricted-forum', 6])
         eq_(403, response.status_code)
 
+    def test_reply_thread_405(self):
+        """Replying to a thread via a GET instead of a POST request."""
+        f = Forum.objects.all()[0]
+        t = f.thread_set.all()[0]
+        self.client.login(username='jsocol', password='testpass')
+        response = get(self.client, 'forums.lock_thread',
+            args=[f.slug, t.id])
+        eq_(405, response.status_code)
 
 class ThreadAuthorityPermissionsTests(ForumTestCase):
     """Test thread views authority permissions."""

apps/forums/views.py

@@ -120,7 +120,7 @@ def posts(request, forum_slug, thread_id, form=None, reply_preview=None):
                          'feeds': feed_urls,
                          'forums': Forum.objects.all()})
 
-
+@require_POST
 @login_required
 def reply(request, forum_slug, thread_id):
     """Reply to a thread."""