diff --git a/media/js/base.js b/media/js/base.js
index c2c7b82540..2918097e98 100644
--- a/media/js/base.js
+++ b/media/js/base.js
@@ -261,6 +261,17 @@ function addConfirmTo(op_ele, popup) {
     });
 }
 
+function addFormPost(op_ele) {
+    op_ele.click(function() {
+        $('<form>', {
+            "method": 'POST',
+            "action": $(this).data('url'),
+            "html": '<input name="csrfmiddlewaretoken" value="' + getCookie('csrftoken') + '" type="hidden">'
+        }).appendTo(document.body).submit();
+        return false;
+    });
+}
+
 /*
  * func: add autocomplete to some input ele
  * @param ele_id: autocomplete is added to this ele(ment), e.g-'#xxx'
diff --git a/seahub/templates/file_revisions.html b/seahub/templates/file_revisions.html
index 8219eeb15f..35d7b0466c 100644
--- a/seahub/templates/file_revisions.html
+++ b/seahub/templates/file_revisions.html
@@ -70,7 +70,7 @@
                 <td>
                     {% if commit.id != repo.head_cmmt_id %}
                     {% if can_revert_file %}
-                    <a href="{{ SITE_ROOT }}repo/revert_file/{{ repo.id }}/?commit={{ commit.id }}&p={{commit.path|urlencode}}&from=file_revisions" class="op vh">{% trans 'Restore' %}</a>
+                    <a href="#" data-url="{% url "repo_revert_file" repo.id %}?commit={{ commit.id }}&p={{commit.path|urlencode}}&from=file_revisions" class="op vh restore-op">{% trans 'Restore' %}</a>
                     {% endif %}
                     {% endif %}
                     <a href="{% url "download_file" repo.id commit.rev_file_id %}?p={{commit.path|urlencode}}" class="op vh">{% trans 'Download' %}</a>
@@ -83,3 +83,9 @@
             {% endfor %}
         </table>
 {% endblock %}
+
+{% block extra_script %}
+<script type="text/javascript">
+addFormPost($('.restore-op'));
+</script>
+{% endblock %}
diff --git a/seahub/templates/repo_history_view.html b/seahub/templates/repo_history_view.html
index e9945d0e98..a1801c0da9 100644
--- a/seahub/templates/repo_history_view.html
+++ b/seahub/templates/repo_history_view.html
@@ -47,7 +47,7 @@
                 </p>
 
                 {% if path == '/' and is_repo_owner %}
-                    <button data-url="{% url 'repo_history_revert' repo.id %}?commit_id={{ current_commit.id }}" id="repo-revert" class="op-btn fright">{% trans "Restore"%}</button>
+                    <button data-url="{% url 'repo_revert_history' repo.id %}?commit_id={{ current_commit.id }}" id="repo-revert" class="op-btn fright">{% trans "Restore"%}</button>
                 {% endif %}
             </div>
             <!-- /.repo-file-list-topbar -->
@@ -64,7 +64,7 @@
                     <td class="alc"><img src="{{ MEDIA_URL }}img/folder-icon-24.png" alt="{% trans "Directory"%}" /></td>
                     <td><a href="{% url 'repo_history_view' repo.id %}?commit_id={{ current_commit.id }}&p={{ path|urlencode }}{{ dirent.obj_name|urlencode }}">{{ dirent.obj_name }}</a></td>              
                     <td></td>
-                    <td><a class="op vh" href="{% url 'repo_revert_dir' repo.id %}?commit={{ current_commit.id }}&p={{ path|urlencode }}{{dirent.obj_name|urlencode}}&from=repo_history">{% trans "Restore" %}</a></td>
+                    <td><a class="op vh restore-dir-op" href="#" data-url="{% url 'repo_revert_dir' repo.id %}?commit={{ current_commit.id }}&p={{ path|urlencode }}{{dirent.obj_name|urlencode}}&from=repo_history">{% trans "Restore" %}</a></td>
                 </tr>
                 {% endfor %}
 
@@ -74,7 +74,7 @@
                     <td><a class="normal" href="{% url 'view_snapshot_file' repo.props.id %}?obj_id={{ dirent.props.obj_id }}&commit_id={{ current_commit.id }}&p={{ path|urlencode }}{{ dirent.obj_name|urlencode }}" target="_blank">{{ dirent.props.obj_name }}</a></td>              
                     <td>{{ dirent.file_size|filesizeformat }}</td>
                     <td>
-                        <a class="op vh" href="{% url 'repo_revert_file' repo.id %}?commit={{ current_commit.id }}&p={{ path|urlencode }}{{dirent.obj_name|urlencode}}&from=repo_history">{% trans "Restore" %}</a>
+                        <a class="op vh restore-file-op" data-url="{% url 'repo_revert_file' repo.id %}?commit={{ current_commit.id }}&p={{ path|urlencode }}{{dirent.obj_name|urlencode}}&from=repo_history" href="#">{% trans "Restore" %}</a>
                         <a class="op vh" href="{% url 'download_file' repo.id dirent.obj_id%}?file_name={{ dirent.obj_name|urlencode }}&p={{path|urlencode}}{{ dirent.obj_name|urlencode }}">{% trans "Download" %}</a>
                     </td>
                 </tr>
@@ -87,7 +87,12 @@
 <script type="text/javascript">
 addConfirmTo($('#repo-revert'), {
     'title':"{% trans "Restore Library" %}",
-    'con':"{% trans "Are you sure you want to restore this library?" %}"
+    'con':"{% trans "Are you sure you want to restore this library?" %}",
+    'post':true
 });
+
+addFormPost($('.restore-file-op'));
+addFormPost($('.restore-dir-op'));
+
 </script>
 {% endblock %}
diff --git a/seahub/templates/repo_recycle_view.html b/seahub/templates/repo_recycle_view.html
index a15ba3084d..76c3181970 100644
--- a/seahub/templates/repo_recycle_view.html
+++ b/seahub/templates/repo_recycle_view.html
@@ -66,7 +66,7 @@
                     <td><a href="?commit_id={{ dirent.commit_id }}&base={{ dirent.basedir|urlencode }}&p=/{{ dirent.obj_name|urlencode }}&days={{days}}">{{ dirent.obj_name }}</a></td>
                     <td>{{ dirent.delete_time|translate_seahub_time }}</td>
                     <td></td>
-                    <td><a class="op vh" href="{% url 'repo_revert_dir' repo.id %}?commit={{ dirent.commit_id }}&p={{ dirent.basedir|urlencode }}{{dirent.obj_name|urlencode}}&from=recycle">{% trans "Restore" %}</a></td>
+                    <td><a class="op vh restore-dir-op" href="#" data-url="{% url 'repo_revert_dir' repo.id %}?commit={{ dirent.commit_id }}&p={{ dirent.basedir|urlencode }}{{dirent.obj_name|urlencode}}&from=recycle">{% trans "Restore" %}</a></td>
                     {% else %}
                     <td><a href="?commit_id={{ commit_id }}&base={{ basedir|urlencode }}&p={{ path|urlencode }}{{ dirent.obj_name|urlencode }}&days={{days}}">{{ dirent.obj_name }}</a></td>
                     <td></td>
@@ -83,7 +83,7 @@
                     <td><a class="normal" href="{% url 'view_trash_file' repo.id %}?obj_id={{ dirent.obj_id }}&commit_id={{ dirent.commit_id }}&base={{ dirent.basedir|urlencode }}&p=/{{ dirent.obj_name|urlencode }}&days={{days}}" target="_blank">{{ dirent.obj_name }}</a></td>
                     <td>{{ dirent.delete_time|translate_seahub_time }}</td>
                     <td>{{ dirent.file_size|filesizeformat }}</td>
-                    <td><a class="op vh" href="{% url 'repo_revert_file' repo.id %}?commit={{ dirent.commit_id }}&p={{ dirent.basedir|urlencode }}{{dirent.obj_name|urlencode}}&from=recycle">{% trans "Restore" %}</a></td>
+                    <td><a class="op vh restore-file-op" href="#" data-url="{% url 'repo_revert_file' repo.id %}?commit={{ dirent.commit_id }}&p={{ dirent.basedir|urlencode }}{{dirent.obj_name|urlencode}}&from=recycle">{% trans "Restore" %}</a></td>
                     {% else %}
                     <td><a class="normal" href="{% url 'view_trash_file' repo.id %}?obj_id={{ dirent.obj_id }}&commit_id={{ commit_id }}&base={{ basedir|urlencode }}&p={{ path|urlencode }}{{ dirent.obj_name|urlencode }}&days={{days}}" target="_blank">{{ dirent.props.obj_name }}</a></td>
                     <td></td>
@@ -120,5 +120,8 @@ $('#online-gc').click(function() {
     $("#simplemodal-container").css({'height':'auto'});
 });
 {% endif %}
+
+addFormPost($('.restore-file-op'));
+addFormPost($('.restore-dir-op'));
 </script>
 {% endblock %}
diff --git a/seahub/urls.py b/seahub/urls.py
index c8a8c44d7b..430795486c 100644
--- a/seahub/urls.py
+++ b/seahub/urls.py
@@ -61,7 +61,7 @@ urlpatterns = patterns(
     # revert file/dir/repo
     url(r'^repo/revert_file/(?P<repo_id>[-0-9a-f]{36})/$', repo_revert_file, name='repo_revert_file'),
     url(r'^repo/revert_dir/(?P<repo_id>[-0-9a-f]{36})/$', repo_revert_dir, name='repo_revert_dir'),
-    url(r'^repo/history/revert/(?P<repo_id>[-0-9a-f]{36})/$', repo_history_revert, name='repo_revert_history'),
+    url(r'^repo/history/revert/(?P<repo_id>[-0-9a-f]{36})/$', repo_revert_history, name='repo_revert_history'),
 
     (r'^repo/upload_check/$', validate_filename),
     url(r'^repo/unsetinnerpub/(?P<repo_id>[-0-9a-f]{36})/$', unsetinnerpub, name='unsetinnerpub'),
diff --git a/seahub/views/__init__.py b/seahub/views/__init__.py
index 85c0399a72..0b126ee525 100644
--- a/seahub/views/__init__.py
+++ b/seahub/views/__init__.py
@@ -973,7 +973,8 @@ def repo_history(request, repo_id):
             }, context_instance=RequestContext(request))
 
 @login_required
-def repo_history_revert(request, repo_id):
+@require_POST
+def repo_revert_history(request, repo_id):
 
     next = request.META.get('HTTP_REFERER', None)
     if not next:
@@ -1216,6 +1217,7 @@ def unlink_device(request):
     return HttpResponse(json.dumps({'success': True}), content_type=content_type)
 
 @login_required
+@require_POST
 def unsetinnerpub(request, repo_id):
     """Unshare repos in organization or in share admin page.
 
@@ -1259,7 +1261,7 @@ def unsetinnerpub(request, repo_id):
                 perm_repo_id = repo.id
                 perm_path =  '/'
 
-            send_perm_audit_msg('delete-repo-perm', username, 'all', \
+            send_perm_audit_msg('delete-repo-perm', username, 'all',
                                 perm_repo_id, perm_path, perm)
 
         messages.success(request, _('Unshare "%s" successfully.') % repo.name)
@@ -1402,6 +1404,7 @@ def render_file_revisions (request, repo_id):
         }, context_instance=RequestContext(request))
 
 @login_required
+@require_POST
 def repo_revert_file(request, repo_id):
     repo = get_repo(repo_id)
     if not repo:
@@ -1460,6 +1463,7 @@ def repo_revert_file(request, repo_id):
         return HttpResponseRedirect(url)
 
 @login_required
+@require_POST
 def repo_revert_dir(request, repo_id):
     repo = get_repo(repo_id)
     if not repo: