ejschmitt/delayed_job_web — pull request #53 by toolmantim (2014-03-07 00:06:39+00:00)
Title: Change destructive actions from GET to POST

It's possible to delete delayed jobs from the database using GET requests. This would allow someone, using just an image tag, to delete arbitrary jobs from the database.

This changes those GET actions to a POST, which partially mitigates the problem. All full fix would also be to require CSRF a token along with the POST request.