Add AntiForgery tokens to some actions that were missing them

src/NuGetGallery/App_Code/ViewHelpers.cshtml

@@ -311,3 +311,10 @@ var hlp = new AccordionHelper(name, formModelStatePrefix, expanded, page);
         }
     </li>
 }
+
+@helper AjaxAntiForgeryToken(System.Web.Mvc.HtmlHelper html)
+{
+    <form id="AntiForgeryForm">
+        @html.AntiForgeryToken()
+    </form>
+}

src/NuGetGallery/Areas/Admin/Controllers/LuceneController.cs

@@ -55,6 +55,7 @@ private async Task<LuceneInfoModel> GetLuceneInfo()
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public virtual Task<ActionResult> Rebuild()
         {
             IndexingService.UpdateIndex(forceRefresh: true);

src/NuGetGallery/Areas/Admin/Controllers/SecurityPolicyController.cs

@@ -71,6 +71,7 @@ public virtual JsonResult Search(string query)
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<JsonResult> Update(List<string> subscriptionsJson)
         {
             var subscribeRequests =  subscriptionsJson?.Select(JsonConvert.DeserializeObject<JObject>)

src/NuGetGallery/Areas/Admin/Controllers/SupportRequestController.cs

@@ -54,6 +54,7 @@ public ActionResult GetAdmins()
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<ActionResult> DisableAdmin(int key)
         {
             try
@@ -69,6 +70,7 @@ public async Task<ActionResult> DisableAdmin(int key)
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<ActionResult> EnableAdmin(int key)
         {
             try
@@ -84,6 +86,7 @@ public async Task<ActionResult> EnableAdmin(int key)
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<ActionResult> AddAdmin(string galleryUsername, string pagerDutyUsername)
         {
             try
@@ -99,6 +102,7 @@ public async Task<ActionResult> AddAdmin(string galleryUsername, string pagerDut
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<ActionResult> UpdateAdmin(int key, string galleryUsername, string pagerDutyUsername)
         {
             try
@@ -114,6 +118,7 @@ public async Task<ActionResult> UpdateAdmin(int key, string galleryUsername, str
         }
 
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public async Task<ActionResult> Save(int issueKey, int? assignedToId, int issueStatusId, string comment)
         {
             try

src/NuGetGallery/Areas/Admin/Views/Lucene/Index.cshtml

@@ -31,10 +31,11 @@ else
     </p>
 }
 
-@if(Model.IsLocal) 
+@if (Model.IsLocal)
 {
     using (Html.BeginForm("Rebuild", "Lucene"))
     {
+        @Html.AntiForgeryToken()
         <fieldset class="form">
             <input type="submit" value="Rebuild Now" />
             <p>NOTE: This will only affect the current instance!</p>

src/NuGetGallery/Areas/Admin/Views/SecurityPolicy/Index.cshtml

@@ -4,6 +4,8 @@
     ViewBag.Title = "Security Policies";
 }
 
+@ViewHelpers.AjaxAntiForgeryToken(Html)
+
 <section>
     <article id="stage">
 
@@ -68,7 +70,7 @@
 @section BottomScripts {
     <script src="@Url.Content("~/Scripts/knockout-2.2.1.js")"></script>
     <script>
-        $(document).ready(function() {
+        $(document).ready(function () {
             var viewModel = function () {
                 var $self = this;
 
@@ -89,8 +91,7 @@
                         cache: false,
                         dataType: 'json',
                         type: 'POST',
-                        data: JSON.stringify(subscriptions),
-                        contentType: 'application/json; charset=utf-8',
+                        data: addAjaxAntiForgeryToken({ subscriptionsJson: subscriptions }),
                         success: function (data) {
                             $self.changeTracker(false);
                             $self.message("Security policies updated!");

src/NuGetGallery/Areas/Admin/Views/SupportRequest/Admins.cshtml

@@ -10,11 +10,12 @@
     @Styles.Render("~/Content/supportrequests")
 }
 
+@ViewHelpers.AjaxAntiForgeryToken(Html)
+
 <section>
     <article id="supportrequests">
         <div style="display: none;" id="addAdmin-dialog">
             <form id="addAdmin-form">
-                @Html.AntiForgeryToken()
                 <fieldset class="form">
                     <legend>Add</legend>
 
@@ -39,7 +40,6 @@
 
         <div style="display: none;" id="editAdmin-dialog">
             <form id="editAdmin-form">
-                @Html.AntiForgeryToken()
                 <fieldset class="form">
                     <legend>Edit</legend>
 
@@ -122,18 +122,17 @@
 
                 this.createAdmin = function (success, error) {
                     var url = '@Url.Action("AddAdmin")';
-                    var model = JSON.stringify({
+                    var model = {
                         galleryUsername: $self.newGalleryUsername(),
                         pagerDutyUsername: $self.newPagerDutyUsername()
-                    });
+                    };
 
                     $.ajax({
                         url: url,
                         type: 'POST',
                         cache: false,
                         dataType: 'json',
-                        contentType: 'application/json; charset=utf-8',
-                        data: model,
+                        data: addAjaxAntiForgeryToken(model),
                         success: success
                     })
                     .error(error);
@@ -148,19 +147,18 @@
 
                 this.updateAdmin = function (success, error) {
                     var url = '@Url.Action("UpdateAdmin")';
-                    var model = JSON.stringify({
+                    var model = {
                         key: $self.admin.Key,
                         galleryUsername: $self.editGalleryUsername,
                         pagerDutyUsername: $self.editPagerDutyUsername
-                    });
+                    };
 
                     $.ajax({
                         url: url,
                         type: 'POST',
                         cache: false,
                         dataType: 'json',
-                        contentType: 'application/json; charset=utf-8',
-                        data: model,
+                        data: addAjaxAntiForgeryToken(model),
                         success: success
                     })
                     .error(error);
@@ -204,9 +202,9 @@
 
                 this.toggleAdminAccess = function (data) {
                     var confirmationText, url;
-                    var model = JSON.stringify({
+                    var model = {
                         key: data.Key
-                    });
+                    };
 
                     if (data.AccessDisabled !== false) {
                         confirmationText = 'Are you sure you want to enable access for ' + data.GalleryUsername + '?';
@@ -222,8 +220,7 @@
                             type: 'POST',
                             cache: false,
                             dataType: 'json',
-                            contentType: 'application/json; charset=utf-8',
-                            data: model,
+                            data: addAjaxAntiForgeryToken(model),
                             success: function () {
                                 $self.refresh();
                             }

src/NuGetGallery/Areas/Admin/Views/SupportRequest/Index.cshtml

@@ -10,6 +10,8 @@
     @Styles.Render("~/Content/supportrequests")
 }
 
+@ViewHelpers.AjaxAntiForgeryToken(Html)
+
 <section>
     <article id="supportrequests">
         <div id="sr-nav-menu">
@@ -50,7 +52,6 @@
 
             <div style="display: none;" id="editSupportRequest-dialog">
                 <form id="editSupportRequest-form">
-                    @Html.AntiForgeryToken()
                     <fieldset class="form">
                         <legend>Edit</legend>
 

src/NuGetGallery/Controllers/CuratedPackagesController.cs

@@ -46,6 +46,7 @@ public virtual ActionResult GetCreateCuratedPackageForm(string curatedFeedName)
 
         [ActionName("CuratedPackage")]
         [HttpDelete]
+        [ValidateAntiForgeryToken]
         public virtual async Task<ActionResult> DeleteCuratedPackage(
             string curatedFeedName,
             string curatedPackageId)
@@ -76,6 +77,7 @@ await CuratedFeedService.DeleteCuratedPackageAsync(
 
         [ActionName("CuratedPackage")]
         [AcceptVerbs("patch")]
+        [ValidateAntiForgeryToken]
         public virtual async Task<ActionResult> PatchCuratedPackage(
             string curatedFeedName,
             string curatedPackageId,
@@ -113,6 +115,7 @@ await CuratedFeedService.ModifyCuratedPackageAsync(
 
         [ActionName("CuratedPackages")]
         [HttpPost]
+        [ValidateAntiForgeryToken]
         public virtual async Task<ActionResult> PostCuratedPackages(
             string curatedFeedName,
             CreateCuratedPackageRequest request)

src/NuGetGallery/Controllers/UsersController.cs

@@ -364,6 +364,7 @@ public virtual ActionResult Profiles(string username, int page = 1, bool showAll
 
         [HttpPost]
         [Authorize]
+        [ValidateAntiForgeryToken]
         public virtual async Task<ActionResult> ChangeEmail(AccountViewModel model)
         {
             if (!ModelState.IsValidField("ChangeEmail.NewEmail"))
@@ -424,6 +425,7 @@ public virtual async Task<ActionResult> ChangeEmail(AccountViewModel model)
 
         [HttpPost]
         [Authorize]
+        [ValidateAntiForgeryToken]
         public virtual async Task<ActionResult> CancelChangeEmail(AccountViewModel model)
         {
             var user = GetCurrentUser();

src/NuGetGallery/Scripts/nugetgallery.js

@@ -1,5 +1,13 @@
 // Global utility script for NuGetGallery
 /// <reference path="jquery-1.11.0.js" />
+
+// Shared function for adding an anti-forgery token defined by ViewHelpers.AjaxAntiForgeryToken to an ajax request
+function addAjaxAntiForgeryToken(data) {
+    var $field = $("#AntiForgeryForm input[name=__RequestVerificationToken]");
+    data["__RequestVerificationToken"] = $field.val();
+    return data;
+}
+
 (function (window, $, undefined) {
     $(function () {
         // Export an object with global config data

src/NuGetGallery/Scripts/supportrequests.js

@@ -16,20 +16,19 @@ function EditViewModel(editUrl) {
     this.issueStatusChoices = ko.observableArray();
 
     this.updateSupportRequest = function (success, error) {
-        var model = JSON.stringify({
+        var model = {
             issueKey: $self.issue.Key,
             assignedToId: $self.editAssignedToId,
             issueStatusId: $self.editIssueStatusId,
             comment: $self.editIssueComment()
-        });
+        };
 
         $.ajax({
             url: editUrl,
             type: 'POST',
             cache: false,
             dataType: 'json',
-            contentType: 'application/json; charset=utf-8',
-            data: model,
+            data: addAjaxAntiForgeryToken(model),
             success: success
         })
         .error(error);

src/NuGetGallery/Views/CuratedFeeds/CuratedFeed.cshtml

@@ -2,14 +2,19 @@
 @{
     ViewBag.Title = "Curated Feed: " + Model.Name;
 }
+
+@ViewHelpers.AjaxAntiForgeryToken(Html)
+
 @section BottomScripts {
     <script>
         var urlFormat = "@Url.RouteUrl(RouteName.CuratedPackage, new { curatedFeedName = Model.Name, curatedPackageId = "PACKAGE_ID" })";
-
+        
         function deleteCuratedPackage(packageId) {
             $.ajax({
                 type: 'delete',
-                url: urlFormat.replace("PACKAGE_ID", packageId)
+                url: urlFormat.replace("PACKAGE_ID", packageId),
+                dataType: 'json',
+                data: addAjaxAntiForgeryToken({})
             })
                 .error(function(jqXhr, textStatus, errorThrown) {
                     alert("Error: " + errorThrown);
@@ -23,7 +28,7 @@
             $.ajax({
                 type: 'patch',
                 url: urlFormat.replace("PACKAGE_ID", packageId),
-                data: { included: included },
+                data: addAjaxAntiForgeryToken({ included: included }),
                 dataType: 'json'
             })
                 .error(function(jqXhr, textStatus, errorThrown) {

src/NuGetGallery/Views/Packages/ManagePackageOwners.cshtml

@@ -3,9 +3,7 @@
     ViewBag.Tab = "Packages";
 }
 
-<form id="AntiForgeryForm">
-    @Html.AntiForgeryToken()
-</form>
+@ViewHelpers.AjaxAntiForgeryToken(Html)
 
 <h1 class="page-heading">Manage Owners for Package "@Model.Title.Abbreviate(50)"</h1>
 
@@ -66,12 +64,6 @@
                 alert('An unexpected error occurred! "' + errorThrown + '"');
             };
 
-            var addAntiForgeryToken = function (data) {
-                var $field = $("#AntiForgeryForm input[name=__RequestVerificationToken]");
-                data["__RequestVerificationToken"] = $field.val();
-                return data;
-            }
-
             var viewModel = {
                 package: { id: '@Model.Id' },
                 owners: ko.observableArray([]),
@@ -145,7 +137,7 @@
                         dataType: 'json',
                         type: 'POST',
                         dataType: 'json',
-                        data: addAntiForgeryToken(ownerInputModel),
+                        data: addAjaxAntiForgeryToken(ownerInputModel),
                         success: function (data) {
                             if (data.success) {
                                 var newOwner = new Owner(data.name, /* pending */ true, data.current);
@@ -182,7 +174,7 @@
                         dataType: 'json',
                         type: 'POST',
                         dataType: 'json',
-                        data: addAntiForgeryToken({}),
+                        data: addAjaxAntiForgeryToken({}),
                         success: function (data) {
                             if (data.success) {
                                 if (item.current) {