activate access tokens using POST

src/c3nav/access/templates/access/activate.html

@@ -10,5 +10,7 @@
         <div class="alert alert-success">
             <strong>{% trans 'Your access token was installed on your device!' %}</strong>
         </div>
+    {% else %}
+        {% include 'access/fragment_token.html' %}
     {% endif %}
 {% endblock %}

src/c3nav/access/templates/access/fragment_token.html

@@ -1,13 +1,17 @@
 {% load i18n %}
 
+<form action="{{ token.activation_url }}" method="POST">
+{% csrf_token %}
 <div class="token">
     <p>
         <img src="{{ token.qr_url }}">
     </p>
+    <p><a href="{{ token.activation_url }}">{% trans 'Link to this token / in this QR code' %}</a></p>
     <p>
-        <a href="{{ token.activation_url }}" class="btn btn-default btn-block">{% trans 'Activate token on this device' %}</a>
+        <button type="submit" class="btn btn-default btn-block">{% trans 'Activate token on this device' %}</button>
     </p>
     <p>
         {% blocktrans %}This link QR Code / Link only works once. If you want access on multiple devices, you need multiple tokens.{% endblocktrans %}
     </p>
 </div>
+</form>

src/c3nav/access/views.py

@@ -75,10 +75,15 @@ def prove(request):
 
 def activate_token(request, pk, secret):
     token = get_object_or_404(AccessToken, expired=False, activated=False, id=pk, secret=secret)
-    request.c3nav_access = token
-    request.c3nav_new_access = True
+    if request.method == 'POST':
+        request.c3nav_access = token
+        request.c3nav_new_access = True
+        return render(request, 'access/activate.html', context={
+            'success': True,
+        })
+
     return render(request, 'access/activate.html', context={
-        'success': True,
+        'token': token,
     })