🛂 don't allow publish via get, as it's considered a safe method

okfde · Dec 16, 2024 · befa14d · befa14d
1 parent b8cf3c9
commit befa14d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/froide/foirequest/api_views/message.py b/froide/foirequest/api_views/message.py
@@ -69,7 +69,7 @@ def get_queryset(self):
         ).order_by()
         return self.optimize_query(qs)
 
-    @action(detail=True, methods=["get", "post"])
+    @action(detail=True, methods=["post"])
     def publish(self, request, pk=None):
         message = self.get_object()
         message.is_draft = False