115 CSRF vulnerability and repair

Brief description: http get can be used to modify user data.
115 http://u.115.com/a large number of use of AJAX to trigger user operations, but AJAX requests not only do not use CSRF token, but also use GET to trigger, resulting in easy construction of a URL to trigger the operation
Vulnerability proof: in any forum to publish a picture of a link to the http://is.gd/jW4CF.jpg, if the user has logged on to the 115 network disk before accessing this page, will create a directory named fb5672 under the user's directory
Solution: Use POST instead of GET for AJAX, and use csrf token to defend against POST-based CSRF attacks