Turn on CSRF protection - all forms must from now on have a {% csrf_token %}

- Legacy-Id: 6963

ietf/dbtemplate/templates/dbtemplate/template_edit.html

@@ -30,7 +30,7 @@
 </dl>
 
 <h2>Edit template content</h2>
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
 {{ form.as_p }}
 <input type="submit" value="Submit changes" />
 </form>

ietf/meeting/views.py

@@ -22,6 +22,7 @@ from django.utils.decorators import decorator_from_middleware
 from django.middleware.gzip import GZipMiddleware
 from django.db.models import Max
 from django.forms.models import modelform_factory
+from django.views.decorators.csrf import ensure_csrf_cookie
 
 from ietf.utils.pipe import pipe
 from ietf.ietfauth.utils import role_required, has_role
@@ -160,6 +161,7 @@ def agenda_create(request, num=None, schedule_name=None):
 
 
 @decorator_from_middleware(GZipMiddleware)
+@ensure_csrf_cookie
 def edit_timeslots(request, num=None):
 
     meeting = get_meeting(num)
@@ -197,6 +199,7 @@ def edit_timeslots(request, num=None):
 #@role_required('Area Director','Secretariat')
 # disable the above security for now, check it below.
 @decorator_from_middleware(GZipMiddleware)
+@ensure_csrf_cookie
 def edit_agenda(request, num=None, schedule_name=None):
 
     if request.method == 'POST':
@@ -286,6 +289,7 @@ AgendaPropertiesForm = modelform_factory(Schedule, fields=('name','visible', 'pu
 
 @role_required('Area Director','Secretariat')
 @decorator_from_middleware(GZipMiddleware)
+@ensure_csrf_cookie
 def edit_agenda_properties(request, num=None, schedule_name=None):
 
     meeting = get_meeting(num)
@@ -304,6 +308,7 @@ def edit_agenda_properties(request, num=None, schedule_name=None):
 
 @role_required('Area Director','Secretariat')
 @decorator_from_middleware(GZipMiddleware)
+@ensure_csrf_cookie
 def edit_agendas(request, num=None, order=None):
 
     #if request.method == 'POST':
@@ -325,6 +330,7 @@ def edit_agendas(request, num=None, order=None):
                                          RequestContext(request)),
                         content_type="text/html")
 
+@ensure_csrf_cookie
 def agenda(request, num=None, name=None, base=None, ext=None):
     base = base if base else 'agenda'
     ext = ext if ext else '.html'

ietf/secr/templates/announcement/confirm.html

@@ -15,7 +15,7 @@
 <div class="module">
     <h2>Announcement</h2>
 
-    <form action="" method="POST">
+    <form action="" method="post">{% csrf_token %}
 
 <pre id="announce-confirm">
 To: {{ to }}

ietf/secr/templates/announcement/main.html

@@ -11,7 +11,7 @@
 <div class="module">
     <h2>Announcement</h2>
     
-    <form action="" method="POST">
+    <form action="" method="post">{% csrf_token %}
     <table class="new-style full-width amstable" id="announce-table">
       {% if form.non_field_errors %}{{ form.non_field_errors }}{% endif %}
       {% for field in form.visible_fields %}

ietf/secr/templates/areas/add.html

@@ -15,7 +15,7 @@
 
 <div class="module">
   <h2>Area - Add</h2>
-  <form enctype="multipart/form-data" action="" method="post">
+  <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
   <table id="area-add-table" class="full-width amstable">
     <col width="150">
     {{ area_form.as_table }}

ietf/secr/templates/areas/edit.html

@@ -15,7 +15,7 @@
 {% block content %}
 
 <div class="module">
-    <form action="." method="post">
+    <form action="." method="post">{% csrf_token %}
     <h2>Area - Edit</h2>
       <table class="full-width amstable">
         <col width="150">

ietf/secr/templates/areas/people.html

@@ -21,7 +21,7 @@
     <h2>Area Directors ({{ area.acronym }})</h2>
       <table class="center">
         {% for director in directors %}
-          <form action="modify/" method="post">
+          <form action="modify/" method="post">{% csrf_token %}
             <input type="hidden" name="tag" value="{{ director.person.id }}" />
             <tr>
               <td id="id-ad-name"><a href="">{{ director.person.name }}</a></td>
@@ -39,7 +39,7 @@
       <div class="inline-related">
         <h3><b>Add new Director</b></h3>
         <p>
-        <form action="." method="post">
+        <form action="." method="post">{% csrf_token %}
           <table class="center">
             {{ form.as_table }}
             <tr>

ietf/secr/templates/drafts/add.html

@@ -16,7 +16,7 @@
 
 <div class="module draft-container">
     <h2>Draft - Add</h2>
-    <form id="drafts-add-form" enctype="multipart/form-data" action="" method="post">
+    <form id="drafts-add-form" enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table class="full-width amstable">
         <col width="150">
         {{ form.as_table }}

ietf/secr/templates/drafts/approvals.html

@@ -14,7 +14,7 @@
 
 <div class="module draft-container">
     <h2>Draft - Approvals</h2>
-    <form id="drafts-approvals-form" enctype="multipart/form-data" action="" method="post">
+    <form id="drafts-approvals-form" enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table class="full-width">
 	{{ form.as_table }}
       </table>

ietf/secr/templates/drafts/authors.html

@@ -43,7 +43,7 @@
     <div class="inline-related">
       <!-- <hr><br> -->
       <h3>Add Author</h3>
-      <form id="groups-people" action="" method="post">
+      <form id="groups-people" action="" method="post">{% csrf_token %}
         {{ form.non_field_errors }}
         <table class="full-width">
           <tr>

ietf/secr/templates/drafts/confirm.html

@@ -16,7 +16,7 @@
 
 <div class="module draft-container">
     <h2>Draft - Confirm</h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       
       <table>
         <tr><th>Action Selected:</th><td>{{ action }}</td></tr>

ietf/secr/templates/drafts/edit.html

@@ -20,7 +20,7 @@
 <div class="module draft-container">
     <h2>Draft - Edit</h2>
     {{ form.non_field_errors }}
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table id="draft-edit-table" class="full-width amstable">
         <tr><th>Document Name:</th><td>{{ form.title.errors }}{{ form.title }}</td></tr>
         <tr><th>Group:</th><td>{{ form.group.errors }}{{ form.group }}</td></tr>

ietf/secr/templates/drafts/email.html

@@ -16,7 +16,7 @@
 
 <div class="module draft-container">
     <h2>Draft - Email</h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table id="draft-email-table" class="full-width">
 	{{ form.as_table }}
       </table>

ietf/secr/templates/drafts/extend.html

@@ -17,7 +17,7 @@
 <div class="module draft-container">
     <h2>Draft - Extend Expiry</h2>
     
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table class="full-width">
         <tr><th><label>Current Expiration Date:</label></th><td>{{ draft.expires|date:"Y-m-d" }}</td></tr>
         {{ form.as_table }}

ietf/secr/templates/drafts/makerfc.html

@@ -18,7 +18,7 @@
 <div class="module draft-container">
   <div id="draft-view-col1">
     <h2>Draft - Make RFC</h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table id="draft-makerfc-table" class="full-width">
         {% if form.non_field_errors %}{{ form.non_field_errors }}{% endif %}
         <tr><th><label for="id_title">RFC Name</label></th><td colspan="3">{{ form.title.errors }}{{ form.title }}</td></tr>

ietf/secr/templates/drafts/replace.html

@@ -16,7 +16,7 @@
 
 <div class="module draft-container">
     <h2>Draft - Replace</h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table class="full-width">
 	{{ form.as_table }}
       </table>

ietf/secr/templates/drafts/revision.html

@@ -17,7 +17,7 @@
 
 <div class="module draft-container">
     <h2>Draft - Revision Data</h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table class="full-width">
         {{ form.as_table }}
       </table>

ietf/secr/templates/drafts/search.html

@@ -14,7 +14,7 @@
 
 <div class="module draft-container">
     <h2>Draft - Search <span class="unlocked"><a href="add/" class="addlink">Add</a></span></h2>
-    <form id="draft-search-form" enctype="multipart/form-data" action="" method="post">
+    <form id="draft-search-form" enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table id="draft-search-table" class="full-width amstable">
         {{ form.as_table }}
       </table>

ietf/secr/templates/drafts/withdraw.html

@@ -16,7 +16,7 @@
 
 <div class="module draft-container">
     <h2>Draft - Withdraw</h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table class="full-width">
 	{{ form.as_table }}
       </table>

ietf/secr/templates/groups/add.html

@@ -15,7 +15,7 @@
 
 <div class="module group-container">
     <h2>Groups - Add</h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table id="groups-table" class="full-width amstable">
         <col width="150">
         {{ form.as_table }}

ietf/secr/templates/groups/edit.html

@@ -16,7 +16,7 @@
 
 <div class="module group-container">
     <h2>Groups - Edit</h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table id="groups-table" class="full-width amstable">
         <col width="150">
         {{ form }}

ietf/secr/templates/groups/edit_gm.html

@@ -17,7 +17,7 @@
 {% block content %}
 
 <div class="module group-container">
-    <form id="edit-gm" enctype="multipart/form-data" action="" method="post">
+    <form id="edit-gm" enctype="multipart/form-data" action="" method="post">{% csrf_token %}
 
 <div class="inline-group">
   <div class="tabular inline-related">

ietf/secr/templates/groups/people.html

@@ -43,7 +43,7 @@
     <div class="inline-related">
       <!-- <hr><br> -->
       <h3>Add Role</h3>
-      <form id="groups-people" action="" method="post">
+      <form id="groups-people" action="" method="post">{% csrf_token %}
         {{ form.non_field_errors }}
         <table class="full-width">
           <tr>

ietf/secr/templates/groups/search.html

@@ -14,7 +14,7 @@
 
 <div class="module group-container">
     <h2>Groups - Search <span class="unlocked"><a href="add/" class="addlink">Add</a></span></h2>
-    <form enctype="multipart/form-data" action="" method="post">
+    <form enctype="multipart/form-data" action="" method="post">{% csrf_token %}
       <table class="full-width amstable">
         {{ form.as_table }}
       </table>

ietf/secr/templates/includes/sessions_request_form.1_2

@@ -1,5 +1,5 @@
          <span class="required">*</span> Required Field 
-         <form id="session-request-form" action="." method="POST" name="form_post">
+         <form id="session-request-form" action="." method="post" name="form_post">
          {% if form.non_field_errors %}{{ form.non_field_errors }}{% endif %}
          <table id="sessions-new-table" cellspacing="1" cellpadding="1" border="0">
            <col width="150">

ietf/secr/templates/includes/sessions_request_form.html

@@ -1,5 +1,5 @@
          <span class="required">*</span> Required Field 
-         <form id="session-request-form" action="." method="POST" name="form_post">
+         <form id="session-request-form" action="." method="post" name="form_post">{% csrf_token %}
          {% if form.non_field_errors %}{{ form.non_field_errors }}{% endif %}
          <table id="sessions-new-table" cellspacing="1" cellpadding="1" border="0">
            <col width="150">

ietf/secr/templates/ipradmin/create.html

@@ -69,7 +69,7 @@ $(function() {
 
 {% block content %}
 <div class="module ipr-container">
-<form method="post">
+<form method="post">{% csrf_token %}
 {{ ipr_contact_formset.management_form }}
 <h2>Add New IPR</h2>
     {% if ipr_detail_form.non_field_errors %}{{ ipr_detail_form.non_field_errors }}{% endif %}

ietf/secr/templates/ipradmin/detail.html

@@ -15,7 +15,7 @@ IPR Admin Detail Page
 
 {% block content %}
 <!-- this form is a kludge to apply the style from previously created update/create pages -->
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
     <h3>{{ ipr_title }}</h3>
 
     {{ header_text|safe }}
@@ -73,21 +73,21 @@ IPR Admin Detail Page
 
     {% for c in controls %}
         {% if c == 'notify' %}
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
     <input type="hidden" name="ipr_id" value="$ipr_id">
     <input type="hidden" name="command" value="notify">
     <input type="submit" name="notice_it" value="Notify the submitter of IPR that is being updated">
 </form>
         {% endif %}
         {% if c == 'post' %}
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
     <input type="hidden" name="ipr_id" value="$ipr_id">
     <input type="hidden" name="command" value="post">
     <input type="submit" name="post_it" value="Post It">
 </form>
         {% endif %}
         {% if c == 'delete' %}
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
     <input type="hidden" name="ipr_id" value="$ipr_id">
     <input type="hidden" name="command" value="delete">
     <input type="submit" name="do_delete" value="Delete">

ietf/secr/templates/ipradmin/notify.html

@@ -31,7 +31,7 @@ IPR Admin Notify Page
 {% endif %}
 
 {% if page_id == 'detail_notify' %}
-  <form action="" method="post">
+  <form action="" method="post">{% csrf_token %}
     <input type="hidden" name="command" value="do_send_update_notification">
     <input type="hidden" name="ipr_id" value="{{ ipr_id }}">
     <h4>Notification to the submitter of IPR that's being updated</h4>
@@ -68,7 +68,7 @@ IETF Secretariat
 {% endif %}
 
 {% if page_id == 'detail_post' %}
-    <form action="" method="post">
+    <form action="" method="post">{% csrf_token %}
     <input type="hidden" name="command" value="do_send_notifications">
     <input type="hidden" name="ipr_id" value="{{ ipr_id }}">
     <h4>Notification to Submitter(s)</h4>
@@ -84,7 +84,7 @@ IETF Secretariat
 {% endif %}
 
 {% if page_id == 'update_post' %}
-    <form action="" method="post">
+    <form action="" method="post">{% csrf_token %}
     <input type="hidden" name="command" value="do_send_notifications">
     <input type="hidden" name="ipr_id" value="{{ ipr_id }}">
     <h4> Notification to the submitter of IPR that's being updated</h4>

ietf/secr/templates/ipradmin/update.html

@@ -68,7 +68,7 @@ $(function() {
 
 {% block content %}
 <div class="module ipr-container">
-<form method="post" action="">
+<form method="post" action="">{% csrf_token %}
 {{ ipr_contact_formset.management_form }}
 <h2>{{ ipr_detail_form.instance.title }}</h2>
     {% if ipr_detail_form.non_field_errors %}{{ ipr_detail_form.non_field_errors }}{% endif %}

ietf/secr/templates/meetings/add.html

@@ -18,7 +18,7 @@
 
 <div  class="module">
   <h2>Proceedings - Add</h2>
-  <form id="proceedings-add-form" enctype="multipart/form-data" action="" method="post">
+  <form id="proceedings-add-form" enctype="multipart/form-data" action="" method="post">{% csrf_token %}
   <table id="proceedings-add-table">
     {{ form.as_table }}
   </table>

ietf/secr/templates/meetings/blue_sheet.html

@@ -26,7 +26,7 @@
   <p>
   Use the form below to upload individual scanned blue sheet documents.
   </p>
-  <form id="rolodex-add-form" enctype="multipart/form-data" action="" method="post">
+  <form id="rolodex-add-form" enctype="multipart/form-data" action="" method="post">{% csrf_token %}
     <table class="full-width amstable">
       <col width="200">
       {{ form.as_table }}

ietf/secr/templates/meetings/edit_meeting.html

@@ -15,7 +15,7 @@
 {% block content %}
 
 <div class="module">
-    <form action="." method="post">
+    <form action="." method="post">{% csrf_token %}
     <h2>Meetings - Edit</h2>
       <table id="proceedings-edit-table">
         {{ form.as_table }}

ietf/secr/templates/meetings/main.html

@@ -18,7 +18,7 @@
            <h3><b>Select a meeting to manage</b></h3>
             
             <br>
-            <form action="" method="post">
+            <form action="" method="post">{% csrf_token %}
             <p>
             {{ form }}
             <input type="submit" value="Select" />

ietf/secr/templates/meetings/non_session.html

@@ -46,7 +46,7 @@
     <br /><hr />
     
     <div>
-    <form id="timeslot-form" action="" method="post">
+    <form id="timeslot-form" action="" method="post">{% csrf_token %}
         <table id="timeslot-form" class="full-width amstable">
           <col width="150">
           {{ form.as_table }}

ietf/secr/templates/meetings/non_session_edit.html

@@ -5,7 +5,7 @@
 <div class="module interim-container">
     <h2>Meeting - {{ meeting }}</h2>
          <p><h3>Session: {{ slot.name }}</h3></p>
-         <form id="non-session-edit-form" enctype="multipart/form-data" action="." method="post">
+         <form id="non-session-edit-form" enctype="multipart/form-data" action="." method="post">{% csrf_token %}
            <table class="full-width amstable">
              {{ form.as_table }}
            </table>

ietf/secr/templates/meetings/rooms.html

@@ -7,7 +7,7 @@
 
           <div class="inline-group">
            <div class="tabular inline-related">
-            <form id="meetings-meta-rooms" action="" method="post">
+            <form id="meetings-meta-rooms" action="" method="post">{% csrf_token %}
               {{ formset.management_form }}
               {{ formset.non_form_errors }}
               <table class="full-width">

ietf/secr/templates/meetings/schedule.html

@@ -53,7 +53,7 @@
     <div class="inline-group">
     <h2>Sessions</h2>
 
-        <form id="meetings-schedule-form" method="post" action="">
+        <form id="meetings-schedule-form" method="post" action="">{% csrf_token %}
         {{ formset.management_form }}
           {% for form in formset.forms %}
             <div class="inline-related{% if forloop.last %} last-related{% endif %}">

ietf/secr/templates/meetings/select_group.html

@@ -21,17 +21,17 @@
       <p>Select this link to <a href="https://datatracker.ietf.org/meeting/{{ meeting.number }}/agenda.html">View Agenda</a></p>
       
       <div class="inline-related">
-        <form class="internal-form" action="" method="post">
+        <form class="internal-form" action="" method="post">{% csrf_token %}
           <label for="id_group">Working Groups</label></th>
           {{ group_form.group }}
           <input type="submit" name="submit" value="Select" />
         </form>
-        <form class="internal-form" action="" method="post">
+        <form class="internal-form" action="" method="post">{% csrf_token %}
           <label for="id_group">BOFs</label>
           {{ bof_form.group }}
           <input type="submit" name="submit" value="Select" />
         </form>
-        <form class="internal-form" action="" method="post">
+        <form class="internal-form" action="" method="post">{% csrf_token %}
           <label for="id_group">IRTF</label>
           {{ irtf_form.group }}
           <input type="submit" name="submit" value="Select" />

ietf/secr/templates/meetings/times.html

@@ -31,7 +31,7 @@
     {% endif %}
     <br /><hr />
     
-    <form action="" method="post">
+    <form action="" method="post">{% csrf_token %}
         {{ form.non_field_errors }}
         <table id="timeslot-form" class="full-width">
           <tr>

ietf/secr/templates/proceedings/convert.html

@@ -15,7 +15,7 @@
 {% block content %}
 
 <div class="module">
-    <form action="." method="post">
+    <form action="." method="post">{% csrf_token %}
     <h2>Proceedings - PPT/DOC Files in Queue</h2>
     <table class="full-width">
     <thead>

ietf/secr/templates/proceedings/edit_slide.html

@@ -27,7 +27,7 @@
 <div class="module interim-container">
     <h2>Working Group - {{ group.acronym }}</h2>
          <p><h3>Edit Slide:</h3></p>
-         <form enctype="multipart/form-data" action="." method="post">
+         <form enctype="multipart/form-data" action="." method="post">{% csrf_token %}
            <table>
              {{ form.as_table }}
            </table>

ietf/secr/templates/proceedings/interim_meeting.html

@@ -35,7 +35,7 @@
      <div class="inline-related">
        <h2>New Meeting</h2>
        <h3>Create a new {{ group.acronym }} Interim Meeting:</h3>
-       <form action="." method="post">
+       <form action="." method="post">{% csrf_token %}
        {{ form.as_p }}
 
        {% include "includes/buttons_submit_back.html" %}

ietf/secr/templates/proceedings/interim_select.html

@@ -23,19 +23,19 @@
            <h3><b>Select Group</b></h3>
            <p>You are authorized to manage interim meetings and meeting materials for the groups below.</p>
            
-           <form class="internal-form" action="" method="post">
+           <form class="internal-form" action="" method="post">{% csrf_token %}
              <label for="id_group">Working Groups</label>
              {{ group_form.group }}
              <input type="submit" name="submit" value="Select" />
            </form>
            {% comment %}
            {% if request.user_is_secretariat %}
-             <form class="internal-form" action="" method="post">
+             <form class="internal-form" action="" method="post">{% csrf_token %}
                <label for="id_group">IRTF Groups</label>
                {{ irtf_form.group }}
                <input type="submit" name="submit" value="Select" />
              </form>
-             <form class="internal-form" action="" method="post">
+             <form class="internal-form" action="" method="post">{% csrf_token %}
                <label for="id_group">Training</label>
                {{ training_form.group }}
                <input type="submit" name="submit" value="Select" />

ietf/secr/templates/proceedings/replace_slide.html

@@ -27,7 +27,7 @@
 <div class="module interim-container">
     <h2>Working Group - {{ group.acronym }}</h2>
          <p><h3>Replace Slide:</h3></p>
-         <form enctype="multipart/form-data" action="." method="post">
+         <form enctype="multipart/form-data" action="." method="post">{% csrf_token %}
            <table>
              {{ form.as_table }}
            </table>

ietf/secr/templates/proceedings/select.html

@@ -52,27 +52,27 @@
            <a href="http://www.ietf.org/instructions/MTG-SLOTS.html">"Requesting Meeting Slots at IETF Meetings."</a>
            <br>
            - To upload meeting materials for a scheduled session, please select the session name below.</p>
-           <form class="internal-form" action="" method="post">
+           <form class="internal-form" action="" method="post">{% csrf_token %}
              <label for="id_group">Working Groups</label>
              {{ group_form.group }}
              <input type="submit" name="submit" value="Select" />
            </form>
            {% if irtf_form %}
-             <form class="internal-form" action="" method="post">
+             <form class="internal-form" action="" method="post">{% csrf_token %}
                <label for="id_group">IRTF Groups</label>
                {{ irtf_form.group }}
                <input type="submit" name="submit" value="Select" />
              </form>
            {% endif %}
            {% if training_form %}
-             <form class="internal-form" action="" method="post">
+             <form class="internal-form" action="" method="post">{% csrf_token %}
                <label for="id_group">Training / Other</label>
                {{ training_form.group }}
                <input type="submit" name="submit" value="Select" />
              </form>
            {% endif %}
            {% if plenary_form %}
-             <form class="internal-form" action="" method="post">
+             <form class="internal-form" action="" method="post">{% csrf_token %}
                <label for="id_group">Plenaries</label>
                {{ plenary_form.group }}
                <input type="submit" name="submit" value="Select" />

ietf/secr/templates/proceedings/status.html

@@ -20,7 +20,7 @@
 <div class="module">
     <h2>IETF  {{ meeting.meeting_num }}</h2>
        <table class="center">
-        <form action="modify/" method="post">
+        <form action="modify/" method="post">{% csrf_token %}
          <tr>   
             <input type="hidden" name="frozen" value="{{ proceeding.frozen }}" />
                   {% if not proceeding.frozen %}

ietf/secr/templates/proceedings/upload_presentation.html

@@ -15,7 +15,7 @@
 
 {% block content %}
 <div class="module">
-    <form  enctype="multipart/form-data" action="" method="post">
+    <form  enctype="multipart/form-data" action="" method="post">{% csrf_token %}
     <h2>Proceedings - Upload (HTML-Zipped) Presentation : <font color="RED">{{ slide.group_name }}</font></h2>
     <p>For Presentation : {{ slide.slide_name }}</p>
     <table>

ietf/secr/templates/proceedings/upload_unified.html

@@ -83,7 +83,7 @@
      
      <div class="inline-related">
        <h2>Upload Materials</h2>
-       <form id="upload_materials_form" enctype="multipart/form-data" action="." method="post">
+       <form id="upload_materials_form" enctype="multipart/form-data" action="." method="post">{% csrf_token %}
        <table class="center" id="proceedings-upload-table">
        {{ form.as_table }}
        </table>

ietf/secr/templates/roles/chairs.html

@@ -28,7 +28,7 @@
     <div class="inline-related">
       <!-- <hr><br> -->
       <h3>Add Role</h3>
-      <form id="groups-people" action="" method="post">
+      <form id="groups-people" action="" method="post">{% csrf_token %}
         {{ form.non_field_errors }}
         <table class="full-width">
           <tr>

ietf/secr/templates/roles/liaisons.html

@@ -7,7 +7,7 @@
       <table class="full-width">
         {% for liaison in liaisons %}
             <tr>
-              <form action="." method="post">
+              <form action="." method="post">{% csrf_token %}
                 <input type="hidden" name="liaison-tag" value="{{ liaison.person.person_or_org_tag }}"
                 <td><a href="{% url "sec.rolodex.views.view" tag=liaison.person.person_or_org_tag %}">{{ liaison.person.first_name }} {{ liaison.person.last_name }}</a></td>
                 <td>{{ liaison.person.affiliation }}</td>
@@ -21,7 +21,7 @@
           <div class="inline-related">
             <h3><b>Add new Liaison</b></h3>
             <p>
-            <form action="." method="post">
+            <form action="." method="post">{% csrf_token %}
             <table class="center">
               {{ form.as_table }}
             </table>

ietf/secr/templates/roles/main.html

@@ -62,7 +62,7 @@
           <h2></h2>
           <h3>Add Role</h3>
           {% with role_form as form %}
-          <form id="roles-form" action="" method="post">
+          <form id="roles-form" action="" method="post">{% csrf_token %}
             {{ role_form.non_field_errors }}
             <table class="full-width">
               <tr>

ietf/secr/templates/rolodex/add.html

@@ -34,7 +34,7 @@
 
 <div class="module">
   <h2>Name</h2>
-  <form id="rolodex-add-form" enctype="multipart/form-data" action="" method="post">
+  <form id="rolodex-add-form" enctype="multipart/form-data" action="" method="post">{% csrf_token %}
     <table class="full-width amstable">
       <col width="200">
       {{ form.as_table }}

ietf/secr/templates/rolodex/add_proceed.html

@@ -10,7 +10,7 @@
 {% block content %}
 <h1>Adding {{ name }}</h1>
 
-<form action="" method="post" id="rolodex-add-form">
+<form action="" method="post" id="rolodex-add-form">{% csrf_token %}
 <div class="module">
 <h2>Rolodex - Add</h2>
   <table class="full-width amstable">

ietf/secr/templates/rolodex/delete.html

@@ -22,7 +22,7 @@
     {% endfor %}
   </ul>
 </li></ul>
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
   <input type="hidden" name="post" value="yes" />
   <input type="submit" value="Yes, I'm sure" />
 </form>

ietf/secr/templates/rolodex/edit.html

@@ -13,7 +13,7 @@
 {% endblock %}
 
 {% block content %}
-<form enctype="multipart/form-data" action="" method="post" id="rolodex-edit-form">
+<form enctype="multipart/form-data" action="" method="post" id="rolodex-edit-form">{% csrf_token %}
 <div class="module">
     <h2>Rolodex - Edit</h2>
     <table id="rolodex-edit-table" class="full-width amstable"">

ietf/secr/templates/rolodex/search.html

@@ -13,7 +13,7 @@
 {% block content %}
 <div class="module">
     <h2>Rolodex - Search <span class="unlocked"><a href="add/" class="addlink">Add</a></span></h2>
-      <form id="rolodex-search-form" action="." method="post">
+      <form id="rolodex-search-form" action="." method="post">{% csrf_token %}
         <table class="full-width amstable">
           <col width="200">
           {{ form.as_table }}

ietf/secr/templates/sreq/confirm.html

@@ -27,7 +27,7 @@
       <br>
     {% endif %}
     
-    <form action="" method="post">
+    <form action="" method="post">{% csrf_token %}
       {% include "includes/buttons_submit_cancel.html" %}
     </form>
 

ietf/secr/templates/sreq/tool_status.html

@@ -16,7 +16,7 @@
 <div class="module interim-container">
     <h2>Sessions - Status</h2>
     <p>Enter the message that you would like displayed to the WG Chair when this tool is locked.</p>
-    <form action="" method="post">
+    <form action="" method="post">{% csrf_token %}
       <table>
       {{ form.as_table }}
       </table>

ietf/secr/templates/telechat/doc.html

@@ -23,7 +23,7 @@
     Number of Open Positions: {{ open_positions }}<br />
     <br />
     <div>
-    <form action="" method="post">
+    <form action="" method="post">{% csrf_token %}
     {{ formset.management_form }}
     <table id="telechat-positions-table">
     <tr><th>Area Director</th><th>Yes</th><th>No Objections</th><th>Discuss</th><th>Abstain</th><th>Recuse</th><th>No Position</th></tr>
@@ -46,7 +46,7 @@
     
     <hr /><br />
     
-    <form action="" method="post">
+    <form action="" method="post">{% csrf_token %}
       <table>
       {{ state_form.as_table }}
       </table>

ietf/secr/templates/telechat/group.html

@@ -1,4 +1,4 @@
-    <form id="dummy" action="" method="post">
+    <form id="dummy" action="" method="post">{% csrf_token %}
     {% if header.2 == "4.1.1 Proposed for IETF Review" %}
       <b>Does anyone have an objection to the creation of this working group being sent for EXTERNAL REVIEW?</b><br><br>
       <input type="radio" name="wg_action_status" value="1"> External Review APPROVED; "The Secretariat will send a Working Group Review announcement with a copy to new-work and place it back on the agenda for the next telechat."<br><br>

ietf/secr/templates/telechat/main.html

@@ -3,7 +3,7 @@
 {% block subsection %}
 <div id="telechat-main">
   <h3>Select a Telechat</h3>
-  <form action="" method="post">
+  <form action="" method="post">{% csrf_token %}
     {{ form.date.label_tag }} {{ form.date }}&nbsp;&nbsp;<button type="submit" name="submit" value="Select">Select</button>
   </form>
   <br>

ietf/secr/templates/telechat/roll_call.html

@@ -10,7 +10,7 @@
   <span class="telechat-warn"><h3>This feature is pending</h3></span>
   <h3>Roll Call</h3>
     <br />
-    <form action="" method="post">
+    <form action="" method="post">{% csrf_token %}
     {% for person in people %}
       <input type="checkbox" name="attendee" value="{{ person.id }}" checked="checked" /> {{ person.name }}<br />
     {% endfor %}

ietf/settings.py

@@ -112,6 +112,7 @@ TEMPLATE_LOADERS = (
 )
 
 MIDDLEWARE_CLASSES = (
+    'django.middleware.csrf.CsrfViewMiddleware',
     'django.middleware.common.CommonMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',

ietf/sync/views.py

@@ -8,6 +8,7 @@ from django.conf import settings
 from django import forms
 from django.db.models import Q
 from django.contrib.auth.models import User
+from django.views.decorators.csrf import csrf_exempt
 
 from ietf.ietfauth.utils import role_required, has_role
 from ietf.doc.models import *
@@ -25,9 +26,10 @@ def discrepancies(request):
                               dict(sections=sections),
                               context_instance=RequestContext(request))
 
+@csrf_exempt # external API so we can't expect the other end to have a token
 def notify(request, org, notification):
-    """Notify that something has changed at another site to trigger a
-    run of one of the sync scripts."""
+    """Notify us that something has changed on an external site so we need to
+    run a sync script."""
 
     known_orgs = {
         "iana": "IANA",
@@ -141,7 +143,7 @@ def rfceditor_undo(request):
 
         e.delete()
 
-        return redirect("ietf.sync.views.rfceditor_undo")
+        return HttpResponseRedirect("")
 
     return render_to_response('sync/rfceditor_undo.html',
                               dict(events=events,

ietf/templates/admin/group/group/send_sdo_reminder.html

@@ -38,7 +38,7 @@ You can send a reminder to each SDO Liaison Manager to request an updated list o
 By clicking the 'Send' button you will send a request to <b>all</b> the SDO Liaison Managers. In order to send the request to one SDO Liaison Manager go to the SDO edit page.
 </p>
 {% endif %}
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
 <input type="submit" name="send" value="Send" />
 </form>
 {% endif %}

ietf/templates/admin/group/sdos/send_reminder.html

@@ -38,7 +38,7 @@ You can send a reminder to each SDO Liaison Manager to request an updated list o
 By clicking the 'Send' button you will send a request to <b>all</b> the SDO Liaison Managers. In order to send the request to one SDO Liaison Manager go to the SDO edit page.
 </p>
 {% endif %}
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
 <input type="submit" name="send" value="Send" />
 </form>
 {% endif %}

ietf/templates/admin/liaisons/sdos/send_reminder.html

@@ -38,7 +38,7 @@ You can send a reminder to each SDO Liaison Manager to request an updated list o
 By clicking the 'Send' button you will send a request to <b>all</b> the SDO Liaison Managers. In order to send the request to one SDO Liaison Manager go to the SDO edit page.
 </p>
 {% endif %}
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
 <input type="submit" name="send" value="Send" />
 </form>
 {% endif %}

ietf/templates/base.html

@@ -99,7 +99,37 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 YAHOO.util.Event.onContentReady("wgs", function () {
     var oMenu = new YAHOO.widget.Menu("wgs", { position: "static", hidedelay:  750, lazyload: true });
     oMenu.render();      
-});      
+});
+// setup CSRF protection
+// using jQuery
+function getCookie(name) {
+    var cookieValue = null;
+    if (document.cookie && document.cookie != '') {
+        var cookies = document.cookie.split(';');
+        for (var i = 0; i < cookies.length; i++) {
+            var cookie = jQuery.trim(cookies[i]);
+            // Does this cookie string begin with the name we want?
+            if (cookie.substring(0, name.length + 1) == (name + '=')) {
+                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+                break;
+            }
+        }
+    }
+    return cookieValue;
+}
+var csrftoken = getCookie('csrftoken');
+function csrfSafeMethod(method) {
+    // these HTTP methods do not require CSRF protection
+    return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
+}
+jQuery.ajaxSetup({
+    crossDomain: false, // obviates need for sameOrigin test
+    beforeSend: function(xhr, settings) {
+        if (!csrfSafeMethod(settings.type)) {
+            xhr.setRequestHeader("X-CSRFToken", csrftoken);
+        }
+    }
+});
 {% block scripts %}
 {% endblock %}
 //]]>

ietf/templates/community/customize_display.html

@@ -1,6 +1,6 @@
 <h2>Display customization</h2>
 
-<form action="#custom" method="POST" />
+<form action="#custom" method="post" />{% csrf_token %}
   <h3>Sort method</h2>
   {{ display_form.sort_method }}
 

ietf/templates/community/manage_clist.html

@@ -70,7 +70,7 @@ In order to add some individual documents to your list you have to:
 </table>
 
 <h3>Add a new rule</h3>
-<form method="post" action="#rules">
+<form method="post" action="#rules">{% csrf_token %}
 {{ rule_form.as_p }}
 <input type="submit" name="save_rule" value="Add rule" />
 </form>

ietf/templates/community/public/subscribe.html

@@ -12,7 +12,7 @@ We have sent an email to your email address with instructions to complete your s
 <p>
 Subscribe to the email list for notifications of {% if significant %}significant {% endif %}changes on {{ cl.long_name }}.
 </p>
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
 <table>
   {{ form }}
 </table>

ietf/templates/community/public/unsubscribe.html

@@ -12,7 +12,7 @@ You will receive a confirmation email shortly containing further instructions on
 <p>
 Cancel your subscription to the email list for notifications of {% if significant %}significant {% endif %}changes on {{ cl.long_name }}.
 </p>
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
 <table>
   {{ form }}
 </table>

ietf/templates/doc/add_comment.html

@@ -18,7 +18,7 @@ form.add-comment .actions {
 
 <p>The comment will be added to the history trail.</p>
 
-<form class="add-comment" action="" method="POST">
+<form class="add-comment" action="" method="post">{% csrf_token %}
   <table>
   {{ form.as_table }}
   <tr>

ietf/templates/doc/ballot/approvaltext.html

@@ -12,7 +12,7 @@ form #id_approval_text {
 {% block content %}
 <h1>Approval announcement writeup for {{ doc }}</h1>
 
-<form action="" method="POST">
+<form action="" method="post">{% csrf_token %}
 
   <p>Sent after approval.</p>
 

ietf/templates/doc/ballot/approve_ballot.html

@@ -23,7 +23,7 @@ form.approve-ballot .announcement {
 
 <div>IETF announcement:</div>
 
-<form class="approve-ballot" action="" method="POST">
+<form class="approve-ballot" action="" method="post">{% csrf_token %}
 
   <div class="announcement">
     <pre>{{ announcement }}</pre>

ietf/templates/doc/ballot/clear_ballot.html

@@ -5,7 +5,7 @@
 {% block content %}
 <h1>Clear ballot for {{ doc }}</h1>
 
-<form action="" method="POST">
+<form action="" method="post">{% csrf_token %}
   <p>Clear the ballot for {{ doc.file_tag }}?</p>
 
   <p>This will clear all ballot positions and discuss entries.</p>

ietf/templates/doc/ballot/defer_ballot.html

@@ -5,7 +5,7 @@
 {% block content %}
 <h1>Defer ballot for {{ doc }}</h1>
 
-<form class="defer" action="" method="POST">
+<form class="defer" action="" method="post">{% csrf_token %}
   <p>Defer the ballot for {{ doc.file_tag }}?</p>
 
   <p>The ballot will then be on the IESG agenda of {{ telechat_date }}.</p>

ietf/templates/doc/ballot/edit_position.html

@@ -46,7 +46,7 @@ div.question {
 <div class="ballot-deferred">Ballot deferred by {{ ballot_deferred.by }} on {{ ballot_deferred.time|date:"Y-m-d" }}.</div>
 {% endif %}
 
-<form class="position-form" action="" method="POST">
+<form class="position-form" action="" method="post">{% csrf_token %}
   <div>
   <span class="position">{{ form.position }}</span>
   <span class="actions">

ietf/templates/doc/ballot/lastcalltext.html

@@ -12,7 +12,7 @@ form #id_last_call_text {
 {% block content %}
 <h1>Last Call text for {{ doc }}</h1>
 
-<form action="" method="POST">
+<form action="" method="post">{% csrf_token %}
 
   <p>{{ last_call_form.last_call_text.errors }}</p>
 

ietf/templates/doc/ballot/send_ballot_comment.html

@@ -14,7 +14,7 @@ form.send-ballot pre {
 {% block content %}
 <h1>Send ballot position email for {{ ad }}</h1>
 
-<form class="send-ballot" action="" method="POST">
+<form class="send-ballot" action="" method="post">{% csrf_token %}
   <table>
     <tr><th>From:</th> <td>{{ frm }}</td></tr>
     <tr><th>To:</th> <td>{{ to }}</td></tr>

ietf/templates/doc/ballot/undefer_ballot.html

@@ -5,7 +5,7 @@
 {% block content %}
 <h1>Undefer ballot for {{ doc }}</h1>
 
-<form class="undefer" action="" method="POST">
+<form class="undefer" action="" method="post">{% csrf_token %}
   <p>Undefer the ballot for {{ doc.file_tag }}?</p>
   
   <p>The ballot will then be on the IESG agenda of {{ telechat_date }}.</p>

ietf/templates/doc/ballot/writeupnotes.html

@@ -13,7 +13,7 @@ form #id_ballot_writeup {
 <h1>Ballot writeup and notes for {{ doc }}</h1>
 
   
-<form action="" method="POST">
+<form action="" method="post">{% csrf_token %}
   
   <p>(Technical Summary, Working Group Summary, Document Quality,
   Personnel, RFC Editor Note, IRTF Note, IESG Note, IANA Note)</p>

ietf/templates/doc/change_ad.html

@@ -14,7 +14,7 @@ Change the shepherding AD for {{titletext}}
 {% block content %}
 <h1>Change the shepherding AD for {{titletext}}</h1>
 
-<form class="edit-info" action="" enctype="multipart/form-data" method="POST">
+<form class="edit-info" action="" enctype="multipart/form-data" method="post">{% csrf_token %}
   <table>
     {% for field in form.visible_fields %}
     <tr>

ietf/templates/doc/change_shepherd.html

@@ -18,7 +18,7 @@ Change the document shepherd for {{ doc.name }}-{{ doc.rev }}
 {% block content %}
 <h1>Change the document shepherd for {{ doc.name }}-{{ doc.rev }}</h1>
 
-<form class="edit-info" action="" enctype="multipart/form-data" method="POST">
+<form class="edit-info" action="" enctype="multipart/form-data" method="post">{% csrf_token %}
   <table>
     {% for field in form.visible_fields %}
     <tr>

ietf/templates/doc/change_state.html

@@ -22,7 +22,7 @@ form.change-state .actions {
 
 <p class="helptext">For help on the states, see the <a href="{{help_url}}">state table</a>.</p>
 
-<form class="change-state" action="" method="post">
+<form class="change-state" action="" method="post">{% csrf_token %}
   <table>
     {% for field in form.visible_fields %}
     <tr>

ietf/templates/doc/conflict_review/approve.html

@@ -15,7 +15,7 @@ form #id_announcement_text {
 {% block content %}
 <h1>Approve {{ review.canonical_name }}</h1>
 
-<form class="approve" action="" method="POST">
+<form class="approve" action="" method="post">{% csrf_token %}
 
   <table>
     {% for field in form.visible_fields %}

ietf/templates/doc/conflict_review/start.html

@@ -20,7 +20,7 @@ form.start-conflict-review .actions {
 
 <p class="helptext">For help on the initial state choice, see the <a href="{% url "state_help" type="conflict-review" %}">state table</a>.</p>
 
-<form class="start-conflict-review" action="" method="post">
+<form class="start-conflict-review" action="" method="post">{% csrf_token %}
   <table>
     {% for field in form.visible_fields %}
     <tr>

ietf/templates/doc/conflict_review/submit.html

@@ -15,7 +15,7 @@ Edit conflict review for {{ conflictdoc.canonical_name }}-{{ conflictdoc.rev }}
 <h1>Edit conflict review for {{ conflictdoc.canonical_name }}-{{ conflictdoc.rev }}</h1>
 
 <p>The text will be submitted as <strong>{{ review.canonical_name }}-{{ next_rev }}</strong></p>
-<form class="edit-info" action="" enctype="multipart/form-data" method="POST">
+<form class="edit-info" action="" enctype="multipart/form-data" method="post">{% csrf_token %}
   <table>
     {% for field in form.visible_fields %}
     <tr>

ietf/templates/doc/draft/adopt_draft.html

@@ -20,7 +20,7 @@ stream state becomes "Call for Adoption by WG Issued". For an RG, the
 draft enters the IRTF stream and the stream state becomes "Active RG
 Document".</p>
 
-<form class="adopt-draft" action="" method="post">
+<form class="adopt-draft" action="" method="post">{% csrf_token %}
   {% for field in form.hidden_fields %}{{ field }}{% endfor %}
   <table>
     {% for field in form.visible_fields %}

ietf/templates/doc/draft/change_ad.html

@@ -14,7 +14,7 @@ Change the shepherding AD for {{ doc.name }}-{{ doc.rev }}
 {% block content %}
 <h1>Change the shepherding AD for {{ doc.name }}-{{ doc.rev }}</h1>
 
-<form class="edit-info" action="" enctype="multipart/form-data" method="POST">
+<form class="edit-info" action="" enctype="multipart/form-data" method="post">{% csrf_token %}
   <table>
     {% for field in form.visible_fields %}
     <tr>

ietf/templates/doc/draft/change_consensus.html

@@ -5,7 +5,7 @@
 {% block content %}
 <h1>Change whether {{ doc.name }}-{{ doc.rev }} is the result of a consensus process</h1>
 
-<form action="" method="POST">
+<form action="" method="post">{% csrf_token %}
   <table>
     {{ form.as_table }}
     <tr>

ietf/templates/doc/draft/change_iana_state.html

@@ -9,7 +9,7 @@ form table .actions { text-align: right; padding-top: 1em; }
 {% block content %}
 <h1>Change IANA state of {{ doc }}</h1>
 
-<form action="" method="post">
+<form action="" method="post">{% csrf_token %}
   <table>
     {{ form.as_table }}
     <tr>

ietf/templates/doc/draft/change_intended_status.html

@@ -15,7 +15,7 @@ form.change-intended-status .actions {
 {% block content %}
 <h1>Change intended status for {{ doc }}</h1>
 
-<form class="change-intended-status" action="" method="post">
+<form class="change-intended-status" action="" method="post">{% csrf_token %}
   <table>
     {{ form.as_table }}
     <tr>

ietf/templates/doc/draft/change_notify.html

@@ -17,7 +17,7 @@ Edit notification addresses for {{ doc.canonical_name }}-{{ doc.rev }}
 {% block content %}
 <h1>Edit notification addresses for {{ doc.canonical_name }}-{{ doc.rev }}</h1>
 
-<form class="edit-info" action="" enctype="multipart/form-data" method="POST">
+<form class="edit-info" action="" enctype="multipart/form-data" method="post">{% csrf_token %}
   <table>
     {% for field in form.visible_fields %}
     <tr>

ietf/templates/doc/draft/change_replaces.html

@@ -63,7 +63,7 @@
 {% block content %}
 <h1>Change which documents {{ doc }} replaces</h1>
 
-<form class="change-replaces" action="" method="post">
+<form class="change-replaces" action="" method="post">{% csrf_token %}
   {{ form.non_field_errors }}
   {{ form.replaces.label_tag }}
   <input type="text" id="id_replaces_search">

ietf/templates/doc/draft/change_shepherd_writeup.html

@@ -14,7 +14,7 @@ Edit shepherd writeup for {{ doc.canonical_name }}-{{ doc.rev }}
 {% block content %}
 <h1>Edit shepherd writeup for {{ doc.canonical_name }}-{{ doc.rev }}</h1>
 
-<form class="edit-info" action="" enctype="multipart/form-data" method="POST">
+<form class="edit-info" action="" enctype="multipart/form-data" method="post">{% csrf_token %}
   <table>
     {% for field in form.visible_fields %}
     <tr>

ietf/templates/doc/draft/change_state.html

@@ -26,7 +26,7 @@ form.change-state .actions {
 
 <p class="helptext">For help on the states, see the <a href="{% url "state_help" type="draft-iesg" %}">state table</a>.</p>
 
-<form class="change-state" action="" method="post">
+<form class="change-state" action="" method="post">{% csrf_token %}
   <table>
     {{ form.as_table }}
     {% if state and state.slug == "rfcqueue" %}
@@ -51,7 +51,7 @@ form.change-state .actions {
 
 <div class="next-states">
   {% for n in next_states %}
-  <form action="" method="post">
+  <form action="" method="post">{% csrf_token %}
     <input type="hidden" name="state" value="{{ n.pk }}" />
     <input type="submit" value="{{ n.name }}" />
   </form>
@@ -62,7 +62,7 @@ form.change-state .actions {
 {% if to_iesg_eval %}
 <h3>You could also jump directly to</h3>
 <div class="warn-states">
-  <form action="" method="post">
+  <form action="" method="post">{% csrf_token %}
     <input type="hidden" name="state" value="{{ to_iesg_eval.pk }}" />
     <input type="submit" value="{{ to_iesg_eval.name }}" />
   </form>
@@ -77,7 +77,7 @@ form.change-state .actions {
 <h3>Or revert to previous state</h3>
 
 <div class="prev-state">
-  <form action="" method="post">
+  <form action="" method="post">{% csrf_token %}
     <input type="hidden" name="state" value="{{ prev_state.pk }}" />
     <input type="submit" value="Back to {{ prev_state.name }}" />
   </form>

ietf/templates/doc/draft/change_stream.html

@@ -15,7 +15,7 @@ form.change-stream .actions {
 {% block content %}
 <h1>Change stream for {{ doc }}</h1>
 
-<form class="change-stream" action="" method="post">
+<form class="change-stream" action="" method="post">{% csrf_token %}
   <table>
     {{ form.as_table }}
     <tr>

ietf/templates/doc/draft/change_stream_state.html

@@ -37,7 +37,7 @@ form.change-state ul li label { cursor: pointer; }
 </div>
 {% endif %}
 
-<form class="change-state" action="" method="post">
+<form class="change-state" action="" method="post">{% csrf_token %}
   <table cellspacing="0">
     {% for field in form.visible_fields %}
     <tr>