Use POST for write web requests

sidekiq-scheduler · Jun 7, 2021 · 00b8459 · 00b8459
1 parent dc7f1f6
commit 00b8459
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 11 deletions.
diff --git a/lib/sidekiq-scheduler/web.rb b/lib/sidekiq-scheduler/web.rb
@@ -15,13 +15,13 @@ def self.registered(app)
         erb File.read(File.join(VIEW_PATH, 'recurring_jobs.erb'))
       end
 
-      app.get '/recurring-jobs/:name/enqueue' do
+      app.post '/recurring-jobs/:name/enqueue' do
         schedule = Sidekiq.get_schedule(params[:name])
         SidekiqScheduler::Scheduler.instance.enqueue_job(schedule)
         redirect "#{root_path}recurring-jobs"
       end
 
-      app.get '/recurring-jobs/:name/toggle' do
+      app.post '/recurring-jobs/:name/toggle' do
         Sidekiq.reload_schedule!
 
         SidekiqScheduler::Scheduler.instance.toggle_job_enabled(params[:name])

diff --git a/spec/sidekiq-scheduler/web_spec.rb b/spec/sidekiq-scheduler/web_spec.rb
@@ -93,11 +93,11 @@
   end
 
   describe '/recurring-jobs/:name/toggle' do
-    subject { get "/recurring-jobs/#{ERB::Util.url_encode(enabled_job_name)}/toggle" }
+    subject { post "/recurring-jobs/#{ERB::Util.url_encode(enabled_job_name)}/toggle" }
 
     it 'toggles job enabled flag' do
       expect { subject }
-        .to change { SidekiqScheduler::Scheduler.job_enabled?(enabled_job_name) }.from(true).to(false)
+      .to change { SidekiqScheduler::Scheduler.job_enabled?(enabled_job_name) }.from(true).to(false)
     end
 
     it 'reloads the schedule' do
@@ -108,7 +108,7 @@
   end
 
   describe 'GET /recurring-jobs/:name/enqueue' do
-    subject { get "/recurring-jobs/#{ERB::Util.url_encode(job_name)}/enqueue" }
+    subject { post "/recurring-jobs/#{ERB::Util.url_encode(job_name)}/enqueue" }
 
     let(:job_name) { enabled_job_name }
     let(:job) { jobs[job_name] }

diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
@@ -13,6 +13,8 @@
 # Load all support files
 Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each { |f| require f }
 
+$TESTING = true
+
 RSpec.configure do |config|
 
   config.after(:each) do

diff --git a/web/views/recurring_jobs.erb b/web/views/recurring_jobs.erb
@@ -34,12 +34,14 @@
             </span>
           </td>
           <td class="text-center">
-            <a class="btn btn-warn btn-xs" href="<%= root_path %>recurring-jobs/<%= ERB::Util.url_encode(job.name) %>/enqueue">
-              <%= t('enqueue_now') %>
-            </a>
-            <a class="btn <%= job.enabled? ? "btn-primary" : "btn-warn"%> btn-xs" href="<%= root_path %>recurring-jobs/<%= ERB::Util.url_encode(job.name) %>/toggle">
-              <%= job.enabled? ? t('disable') : t('enable') %>
-            </a>
+            <form action="<%= root_path %>recurring-jobs/<%= ERB::Util.url_encode(job.name) %>/enqueue" method="post">
+              <%= csrf_tag %>
+              <input type="submit" class="btn btn-warn btn-xs" value="<%= t('enqueue_now') %>" />
+            </form>
+            <form action="<%= root_path %>recurring-jobs/<%= ERB::Util.url_encode(job.name) %>/toggle" method="post">
+              <%= csrf_tag %>
+              <input type="submit" class="btn <%= job.enabled? ? "btn-primary" : "btn-warn"%> btn-xs" value="<%= job.enabled? ? t('disable') : t('enable') %>" />
+            </form>
           </td>
         </tr>
       <% end %>