Require POST for make_friend and remove_friend

[rails.git] / app / views / user / _contact.html.erb

diff --git a/app/views/user/_contact.html.erb b/app/views/user/_contact.html.erb
index d720353eed82308a9fd6ea604bc09650b5cc39bd..2418ed24cdc10d18581f51747395eb4d7b419eaa 100644 (file)
--- a/app/views/user/_contact.html.erb
+++ b/app/views/user/_contact.html.erb
@@ -33,9 +33,9 @@
     <%= link_to t('user.view.send message'), :controller => 'message', :action => 'new', :display_name => contact.display_name %>
     |
     <% if @user.is_friends_with?(contact) %>
-      <%= link_to t('user.view.remove as friend'), :controller => 'user', :action => 'remove_friend', :display_name => contact.display_name, :referer => request.request_uri %>
+      <%= link_to t('user.view.remove as friend'), :controller => 'user', :action => 'remove_friend', :display_name => contact.display_name, :referer => request.fullpath, :method => :post %>
     <% else %>
-      <%= link_to t('user.view.add as friend'), :controller => 'user', :action => 'make_friend', :display_name => contact.display_name, :referer => request.request_uri %>
+      <%= link_to t('user.view.add as friend'), :controller => 'user', :action => 'make_friend', :display_name => contact.display_name, :referer => request.fullpath, :method => :post %>
     <% end %>
   </td>
 </tr>