- op = getattr(self, 'root', None)
- if callable(op):
- return op(*args, **kwargs)
+ if self.form:
+ self._debug("method: %s" % cherrypy.request.method)
+ op = getattr(self, cherrypy.request.method, None)
+ if callable(op):
+ # Basic CSRF protection
+ if cherrypy.request.method != 'GET':
+ if 'referer' not in cherrypy.request.headers:
+ return cherrypy.HTTPError(403)
+ referer = cherrypy.request.headers['referer']
+ url = cherrypy.url(relative=False)
+ if referer != url:
+ return cherrypy.HTTPError(403)
+ return op(*args, **kwargs)
+ else:
+ op = getattr(self, 'root', None)
+ if callable(op):
+ return op(*args, **kwargs)