Add uuid to prevent form resubmission

omero_signup/templates/signup/index.html

@@ -115,6 +115,8 @@
 				{% endif %}
 			</div>
 
+            <input name="requestid" type="hidden" value="{{ requestid }}" />
+
             <div>
                 <input type="submit" value="Create account"/>
             </div>

omero_signup/views.py

@@ -5,6 +5,7 @@
 import random
 import string
 from datetime import datetime
+from uuid import uuid4
 
 from django.conf import settings
 from django.http import HttpResponse, HttpResponseRedirect
@@ -77,13 +78,19 @@ def handle_not_logged_in(self, request, error=None, form=None):
         """
         Signup form
         """
+
+        # Store id in session to prevent forum resubmission
+        requestid = str(uuid4())
+        request.session['requestid'] = requestid
+
         if form is None:
             form = self.form_class()
         context = {
             'version': omero_version,
             'build_year': build_year,
             'error': error,
-            'form': form
+            'form': form,
+            'requestid': requestid,
         }
         if hasattr(settings, 'LOGIN_LOGO'):
             context['LOGIN_LOGO'] = settings.LOGIN_LOGO
@@ -100,7 +107,12 @@ def post(self, request):
         error = None
         form = self.form_class(request.POST.copy())
 
-        if form.is_valid():
+        session_requestid = request.session.pop('requestid', None)
+        post_requestid = request.POST.get('requestid')
+        if not session_requestid or session_requestid != post_requestid:
+            error = 'Invalid requestid: %s' % post_requestid
+
+        if not error and form.is_valid():
             user = dict(
                 firstname=form.cleaned_data['firstname'],
                 lastname=form.cleaned_data['lastname'],