Prevent accidental disconnect from Stripe

src/pretix/plugins/stripe/payment.py

@@ -116,7 +116,7 @@ class StripeSettingsHolder(BasePaymentProvider):
                 )
             else:
                 return (
-                    "<button formaction='{}' class='btn btn-danger'>{}</button>"
+                    "<a href='{}' class='btn btn-danger'>{}</a>"
                 ).format(
                     reverse('plugins:stripe:oauth.disconnect', kwargs={
                         'organizer': self.event.organizer.slug,

src/pretix/plugins/stripe/templates/pretixplugins/stripe/oauth_disconnect.html

@@ -0,0 +1,20 @@
+{% extends "pretixcontrol/base.html" %}
+{% load i18n %}
+{% block title %}{% trans "Stripe Connect" %}{% endblock %}
+{% block content %}
+    <h1>
+        {% trans "Stripe Connect" %}
+    </h1>
+
+    <form action="" method="post" class="form-horizontal" enctype="multipart/form-data">
+        {% csrf_token %}
+        <p>
+            {% trans "Do you really want to disconnect your Stripe account?" %}
+        </p>
+        <div class="form-group submit-group">
+            <button type="submit" class="btn btn-danger btn-save">
+                {% trans "Disconnect" %}
+            </button>
+        </div>
+    </form>
+{% endblock %}

src/pretix/plugins/stripe/views.py

@@ -455,8 +455,10 @@ def paymentintent_webhook(event, event_json, paymentintent_id, rso):
 
 
 @event_permission_required('can_change_event_settings')
-@require_POST
 def oauth_disconnect(request, **kwargs):
+    if request.method != "POST":
+        return render(request, 'pretixplugins/stripe/oauth_disconnect.html', {})
+
     del request.event.settings.payment_stripe_publishable_key
     del request.event.settings.payment_stripe_publishable_test_key
     del request.event.settings.payment_stripe_connect_access_token