Only send mail from contact-info on POST requests.

[mauritsvanrees]

See #4360

[mister-roboto]

@mauritsvanrees thanks for creating this Pull Request and helping to improve Plone!

TL;DR: Finish pushing changes, pass all other checks, then paste a comment:

@jenkins-plone-org please run jobs

To ensure that these changes do not break other parts of Plone, the Plone test suite matrix needs to pass, but it takes 30-60 min. Other CI checks are usually much faster and the Plone Jenkins resources are limited, so when done pushing changes and all other checks pass either start all Jenkins PR jobs yourself, or simply add the comment above in this PR to start all the jobs automatically.

Happy hacking!

[mauritsvanrees]

@jenkins-plone-org please run jobs

[erral]

Can we use plone.protect for this?

It has decorators or authenticators for this kind of protections. And we would be eating our own dog food, right?

[erral]

Or better even, don't z3c.form forms have a method = 'post' attribute than force them to be a POST?

[mauritsvanrees]

plone.protect has postOnly, see the readme. But using it as a decorator only works when the function has a REQUEST parameter.

We could directly pass the request to this function:

from plone.protect import PostOnly
PostOnly(self.request)

I am fine with allowing the GET request and simply ignoring the query parameters, as in my PR. But there is something to be said for denying it with postOnly.

I don't see anything in z3c.form for this. At least: searching for self.method finds nothing, and even searching for POST or GET. Ah, there is an interface with a field method, but I don't see any code reading this.