Applying security fix

http://docs.orchardproject.net/Documentation/Patch-20150519

src/Orchard.Web/Modules/Orchard.Users/Controllers/AdminController.cs

@@ -188,7 +188,9 @@ namespace Orchard.Users.Controllers {
             return RedirectToAction("Index");
         }
 
-        public ActionResult SendChallengeEmail(int id) {
+        [HttpPost]
+        public ActionResult SendChallengeEmail(int id)
+        {
             if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
                 return new HttpUnauthorizedResult();
 
@@ -203,7 +205,9 @@ namespace Orchard.Users.Controllers {
             return RedirectToAction("Index");
         }
 
-        public ActionResult Approve(int id) {
+        [HttpPost]
+        public ActionResult Approve(int id)
+        {
             if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
                 return new HttpUnauthorizedResult();
 
@@ -217,7 +221,9 @@ namespace Orchard.Users.Controllers {
             return RedirectToAction("Index");
         }
 
-        public ActionResult Moderate(int id) {
+        [HttpPost]
+        public ActionResult Moderate(int id)
+        {
             if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
                 return new HttpUnauthorizedResult();
 

src/Orchard.Web/Modules/Orchard.Users/Views/Admin/Index.cshtml

@@ -37,12 +37,12 @@
                     @Html.ActionLink(T("Edit").ToString(), "Edit", new { row.UserPart.Id }) |
                     @Html.ActionLink(T("Remove").ToString(), "Delete", new { row.UserPart.Id }) |
                     @if(row.UserPart.RegistrationStatus == UserStatus.Pending) {
-                        @Html.ActionLink(T("Approve").ToString(), "Approve", new { row.UserPart.Id })
+                        @Html.ActionLink(T("Approve").ToString(), "Approve", new { row.UserPart.Id }, new { itemprop = "UnsafeUrl" })
                     } else {
-                        @Html.ActionLink(T("Disable").ToString(), "Moderate", new { row.UserPart.Id })
+                        @Html.ActionLink(T("Disable").ToString(), "Moderate", new { row.UserPart.Id }, new { itemprop = "UnsafeUrl" })
                     }
                     @if ( row.UserPart.EmailStatus == UserStatus.Pending ) { <text>|</text>
-                        @Html.ActionLink(T("Send challenge E-mail").ToString(), "SendChallengeEmail", new { row.UserPart.Id })
+                        @Html.ActionLink(T("Send challenge E-mail").ToString(), "SendChallengeEmail", new { row.UserPart.Id }, new { itemprop = "UnsafeUrl" })
                     } 
                 </td>
             </tr>