Index: www/controllers/attachment.php
===================================================================
--- www/controllers/attachment.php	(revision 935)
+++ www/controllers/attachment.php	(working copy)
@@ -25,11 +25,11 @@
     $view = array();
     $options = pager_init_options();
 
-    $attach_list = attachment_get_all($page_name, "%", $options['first_entry'], 
+    $attach_list = attachment_get_all($page_name, "%", $options['first_entry'],
                                       $options['display_entries']);
     //FIXME: hack for numbering
     for ($i = 0; $i < count($attach_list); ++$i) {
-        $attach_list[$i]['id'] = $options['first_entry'] + $i + 1; 
+        $attach_list[$i]['id'] = $options['first_entry'] + $i + 1;
     }
     $view['attach_list'] = $attach_list;
     $view['page_name'] = $page['name'];
@@ -132,7 +132,6 @@
             if (isset($att['disk_name']) || !isset($att['zipindex'])) {
                 continue;
             }
-            
 
             // extract archived file to a tempory file on disk
             $tmpname = tempnam(IA_ROOT_DIR . 'attach/', 'iatmp');
@@ -168,9 +167,9 @@
             if (!isset($file_att['disk_name'])) {
                 continue;
             }
-            
+
             if (is_textfile($file_att['type'])) {
-                dos_to_unix($file_att['disk_name']);          
+                dos_to_unix($file_att['disk_name']);
                 $file_att['size'] = filesize($file_att['disk_name']);
             }
 
@@ -245,10 +244,12 @@
 }
 
 // Delete an attachment.
-// FIXME: we get the file from _GET. Add it as a parameter.
-function controller_attachment_delete($page_name) {
-    // FIXME: parameter.
-    $file_name = request('file');
+function controller_attachment_delete($page_name, $file_name) {
+    if (!request_is_post()) {
+        flash_error("Atasamentul nu a putut fi sters!");
+        redirect(url_attachment_list($page_name));
+    }
+
     if (!is_attachment_name($file_name)) {
         flash_error('Nume invalid.');
         redirect(url_textblock($page_name));
@@ -271,41 +272,46 @@
     flash('Fisierul '.$file_name.' a fost sters cu succes.');
     redirect(url_textblock($page_name));
 }
-    
-function controller_attachment_rename($page_name, $old_name, $new_name) { 
-    if (!is_attachment_name($old_name) || !is_attachment_name($new_name)) { 
-        flash_error('Nume invalid.'); 
-        redirect(url_textblock($page_name)); 
-    } 
 
+function controller_attachment_rename($page_name, $old_name, $new_name) {
+    if (!request_is_post()) {
+        flash_error("Atasamentul nu a putut fi redenumit!");
+        redirect(url_attachment_list($page_name));
+    }
+
+    if (!is_attachment_name($old_name) || !is_attachment_name($new_name)) {
+        flash_error('Nume invalid.');
+        redirect(url_textblock($page_name));
+    }
+
     // don't be redundant
     if ($old_name == $new_name) {
         redirect(url_attachment_list($page_name));
     }
 
-    $old_attach = attachment_get($old_name, $page_name); 
-    identity_require('attach-rename', $old_attach); 
-    if (!$old_attach) { 
-        flash_error('Fisierul nu exista.'); 
-        redirect(url_textblock($page_name)); 
-    } 
+    $old_attach = attachment_get($old_name, $page_name);
+    identity_require('attach-rename', $old_attach);
+    if (!$old_attach) {
+        flash_error('Fisierul nu exista.');
+        redirect(url_textblock($page_name));
+    }
 
-    $new_attach = attachment_get($new_name, $page_name); 
-    if ($new_attach) { 
-        flash_error("Exista deja un fisier cu numele $new_name atasat paginii $page_name."); 
-        redirect(url_textblock($page_name)); 
-    }; 
-  
-    // Rename in data base. 
-    if (!attachment_rename($old_attach, $new_name)) { 
-        flash_error('Nu am reusit sa redenumesc fisierul.'); 
-        redirect(url_textblock($page_name)); 
-    } 
-  
+    $new_attach = attachment_get($new_name, $page_name);
+    if ($new_attach) {
+        flash_error("Exista deja un fisier cu numele $new_name atasat paginii $page_name.");
+        redirect(url_textblock($page_name));
+    };
+
+    // Rename in data base.
+    if (!attachment_rename($old_attach, $new_name)) {
+        flash_error('Nu am reusit sa redenumesc fisierul.');
+        redirect(url_textblock($page_name));
+    }
+
     // Everything went ok
-    flash('Fisierul '.$old_name.' a fost redenumit cu succes in '.$new_name); 
-    redirect(url_textblock($page_name)); 
-} 
+    flash('Fisierul '.$old_name.' a fost redenumit cu succes in '.$new_name);
+    redirect(url_textblock($page_name));
+}
 
 // Does NOT print error message. Instead it returns HTTP 403/404.
 //
Index: www/controllers/logout.php
===================================================================
--- www/controllers/logout.php	(revision 935)
+++ www/controllers/logout.php	(working copy)
@@ -1,7 +1,10 @@
 <?php
 
 function controller_logout() {
-    // check permissions
+    if (!request_is_post()) {
+        flash_error("Sesiunea nu a putut fi inchisa!");
+        redirect(url_home());
+    }
     identity_end_session();
 
     flash('Sesiunea a fost inchisa!');
Index: www/controllers/textblock.php
===================================================================
--- www/controllers/textblock.php	(revision 935)
+++ www/controllers/textblock.php	(working copy)
@@ -105,6 +105,11 @@
 // Restore a certain revision
 // This copies the old revision on top.
 function controller_textblock_restore($page_name, $rev_num) {
+    if (!request_is_post()) {
+        flash_error("Pagina nu a putut fi inlocuita!");
+        redirect(url_textblock($page_name));
+    }
+
     global $identity_user;
     $page = textblock_get_revision($page_name);
     $rev = textblock_get_revision($page_name, $rev_num);
@@ -128,6 +133,7 @@
     textblock_add_revision($rev['name'], $rev['title'], $rev['text'],
                            getattr($identity_user, 'id'), $rev['security'],
                            null, $rev['creation_timestamp']);
+    flash("Pagina a fost inlocuita cu revizia {$rev_num}");
     redirect(url_textblock($page_name));
 }
 
@@ -157,10 +163,10 @@
     //log_print($options['first_entry']." -> ".$options['display_entries']. " $start -> $count, $total");
     $revs = textblock_get_revision_list(
             $page_name, false, true,
-            $start, $count); 
+            $start, $count);
     // FIXME: horrible hack, add revision_id column.
     for ($i = 0; $i < count($revs); ++$i) {
-        $revs[$i]['revision_id'] = $start + $i; 
+        $revs[$i]['revision_id'] = $start + $i;
     }
 
     $view = array();
@@ -176,6 +182,11 @@
 
 // Delete a certain textblock.
 function controller_textblock_delete($page_name) {
+    if (!request_is_post()) {
+        flash_error("Pagina nu a putut fi stearsa!");
+        redirect(url_textblock($page_name));
+    }
+
     // Get actual page.
     $page = textblock_get_revision($page_name);
 
Index: www/controllers/textblock_move.php
===================================================================
--- www/controllers/textblock_move.php	(revision 935)
+++ www/controllers/textblock_move.php	(working copy)
@@ -16,8 +16,6 @@
         redirect(url_home());
     }
 
-    //log_print_r($_REQUEST);
-
     $values = array();
     $errors = array();
 
Index: www/format/format.php
===================================================================
--- www/format/format.php	(revision 935)
+++ www/format/format.php	(working copy)
@@ -68,6 +68,36 @@
     return format_tag("a", $content, $attr, $escape);
 }
 
+// Build a link which posts data to a page
+function format_post_link($url, $content, $post_data = array(), $escape = true, $attr = array(), $accesskey = null) {
+    $link_post_data = '{';
+    if (is_array($post_data)) {
+        foreach ($post_data as $key => $value) {
+            log_assert($key == html_escape($key));
+            log_assert($value == html_escape($value));
+            $link_post_data .= $key . ": '" . $value . "'";
+        }
+    }
+    $link_post_data .= "}";
+
+    $link_url = "javascript:PostData('" . $url . "', {$link_post_data})";
+
+    if (is_null($accesskey)) {
+        $link = format_link($link_url, $content, $escape, $attr);
+    } else {
+        $link = format_link_access($link_url, $content, $accesskey, $attr);
+    }
+
+    // Display a little "check" button beside the link if javascript is disabled
+    $form_content = '<input type="submit" style="margin: 0; padding: 0" value="&#10003;" />';
+    $form_attr = array("style" => "margin: 0; padding: 0; display: inline",
+                       "method" => "post",
+                       "action" => $url,
+                      );
+
+    return $link . "<noscript>" . format_tag("form", $form_content, $form_attr, false) . "</noscript>";
+}
+
 // Highlight an access key in a string, by surrounding the first occurence
 // of the $key with <span class="access-key"></span>
 // Case insensitive, nothing happens if $key is not found.
Index: www/index.php
===================================================================
--- www/index.php	(revision 935)
+++ www/index.php	(working copy)
@@ -195,12 +195,12 @@
 //  - attachment delete
 else if ($action == 'attach-del') {
     require_once(IA_ROOT_DIR.'www/controllers/attachment.php');
-    controller_attachment_delete($page);
+    controller_attachment_delete($page, request('file'));
 }
 //  - attachment rename
 else if ($action == 'attach-rename') {
     require_once(IA_ROOT_DIR.'www/controllers/attachment.php');
-    controller_attachment_rename($page, $_POST['old_name'], $_POST['new_name']);
+    controller_attachment_rename($page, request('old_name'), request('new_name'));
 }
 //  - attachment download
 else if ($action == 'download') {
Index: www/static/js/postdata.js
===================================================================
--- www/static/js/postdata.js	(revision 0)
+++ www/static/js/postdata.js	(revision 0)
@@ -0,0 +1,20 @@
+/**
+ * DHTML for posting data
+ * (c) 2006 infoarena
+ */
+
+function PostData(url, data) {
+	var myForm = document.createElement("form");
+	myForm.method = "post";
+	myForm.action = url;
+	for (var k in data) {
+		var myInput = document.createElement("input") ;
+		myInput.setAttribute("name", k);
+		myInput.setAttribute("value", data[k]);
+		myForm.appendChild(myInput);
+	}
+
+	document.body.appendChild(myForm);
+	myForm.submit();
+	document.body.removeChild(myForm);
+}
Index: www/views/header.php
===================================================================
--- www/views/header.php	(revision 935)
+++ www/views/header.php	(working copy)
@@ -41,6 +41,7 @@
     <script type="text/javascript" src="<?= html_escape(url_static('js/tabber-minimized.js')) ?>"></script>
     <script type="text/javascript" src="<?= html_escape(url_static('js/submit.js')) ?>"></script>
     <script type="text/javascript" src="<?= html_escape(url_static('js/remotebox.js')) ?>"></script>
+    <script type="text/javascript" src="<?= html_escape(url_static('js/postdata.js')) ?>"></script>
     <script type="text/javascript" src="<?= html_escape(url_static('js/sh/shCore.js')) ?>"></script>
     <script type="text/javascript" src="<?= html_escape(url_static('js/sh/shBrushCpp.js')) ?>"></script>
     <script type="text/javascript" src="<?= html_escape(url_static('js/sh/shBrushDelphi.js')) ?>"></script>
Index: www/views/listattach.php
===================================================================
--- www/views/listattach.php	(revision 935)
+++ www/views/listattach.php	(working copy)
@@ -50,9 +50,10 @@
 function format_operations($row) {
     global $page_name;
     
-    $delurl = '<a href="';
-    $delurl .= html_escape(url_attachment_delete($page_name, $row['name']));
-    $delurl .= "\" onclick=\"return confirm('Aceasta actiune este ireversibila! Doresti sa continui?')\">Sterge</a>";
+    $delurl = format_post_link(url_attachment_delete($page_name, $row['name']),
+                               "Sterge", array(), true,
+                               array("onclick" => "return confirm('Aceasta actiune este ireversibila! Doresti sa continui?')"));
+
     $renurl = '<a href="#" id="rename_link_'.$row['id'].'" onclick="rename_form('.$row['id'].')">Redenumeste</a>';
 
     return '['.$delurl.'] ['.$renurl.']';
Index: www/views/sitewide.php
===================================================================
--- www/views/sitewide.php	(revision 935)
+++ www/views/sitewide.php	(working copy)
@@ -16,13 +16,13 @@
     <?php if (!identity_is_anonymous()) { $username = $identity_user['username']; ?>
         <div id="userbox">
         <?= format_link(url_user_profile($username, true), format_user_avatar($username, 50, 50, true), false) ?>
-            <span class="user">
+            <div class="user">
                 <strong><?= html_escape($identity_user['full_name']) ?></strong><br/>
                 <?= format_user_ratingbadge($username, $identity_user['rating_cache']) ?>
                 <?= format_link_access(url_user_profile($username, true), $username, 'p') ?><br/>
-                <?= format_link(url_logout(), "logout", true, array('class' => 'logout')) ?> |
+                <?= format_post_link(url_logout(), "logout", array(), true, array('class' => 'logout')) ?> |
                 <?= format_link_access(url_account(), 'contul meu', 'c') ?>
-            </span>
+            </div>
         </div>
     <?php } ?>
     <?php if (IA_DEVELOPMENT_MODE) { ?>
Index: www/views/textblock_header.php
===================================================================
--- www/views/textblock_header.php	(revision 935)
+++ www/views/textblock_header.php	(working copy)
@@ -19,9 +19,9 @@
 <li><?= format_link_access(url_textblock_move($textblock['name']), 'Muta', 'u') ?></li>
 <?php } ?>
 <?php if (identity_can('textblock-delete', $textblock)) { ?>
-<li><?= format_link_access(
+<li><?= format_post_link(
     url_textblock_delete($textblock['name']),
-    'Sterge', 's', array('onclick' =>
+    'Sterge', array(), false, array('onclick' =>
     "return confirm('Aceasta actiune este ireversibila! Doresti sa continui?')")) ?>
 </li>
 <?php } ?>
Index: www/views/textblock_history.php
===================================================================
--- www/views/textblock_history.php	(revision 935)
+++ www/views/textblock_history.php	(working copy)
@@ -31,7 +31,7 @@
         return '<strong>Ultima versiune</strong>';
     } else {
         return  '['. format_link($diffurl, "Compara") .'] '.
-                '['. format_link($resturl, "Inlocuieste") .'] '.
+                '['. format_post_link($resturl, "Inlocuieste") .'] '.
                 '['. format_link($viewurl, "Vezi") .'] '.
                 '['. format_link($delurl, "Sterge") .']';
     }
