diff --git a/progit/static/progit.css b/progit/static/progit.css
index d2a71dd..3873ec5 100644
--- a/progit/static/progit.css
+++ b/progit/static/progit.css
@@ -437,6 +437,10 @@ td.noresult {
     overflow: auto;
 }
 
+.pr_actions form {
+    display: inline-block;
+}
+
 .user_list li {
     list-style-type: none;
     display: inline-block;
diff --git a/progit/templates/pull_request.html b/progit/templates/pull_request.html
index 08ab422..0c3d7dd 100644
--- a/progit/templates/pull_request.html
+++ b/progit/templates/pull_request.html
@@ -21,15 +21,17 @@
 {% if request %}
 <h3>Title: {{ request.title }}</h3>
   {% if request.status and repo_admin %}
-  <div>
-    <a href="{{ url_for('merge_request_pull', username=username,
-              repo=repo.name, requestid=requestid) }}">
-        <button>Merge</button>
-    </a>
-    <a href="{{ url_for('cancel_request_pull', username=username,
-              repo=repo.name, requestid=requestid) }}" id="cancel_pr">
-        <button>Cancel</button>
-    </a>
+  <div class="pr_actions">
+    <form action="{{ url_for('merge_request_pull', username=username,
+        repo=repo.name, requestid=requestid) }}" method="POST">
+        {{ mergeform.csrf_token }}
+        <input type="submit" value="Merge"/>
+    </form>
+    <form action="{{ url_for('cancel_request_pull', username=username,
+        repo=repo.name, requestid=requestid) }}" method="POST">
+        {{ mergeform.csrf_token }}
+        <input type="submit" value="Cancel" id="cancel_pr"/>
+    </form>
   </div>
   {% elif request and request.status == False %}
   <span class="error">Merged</span>
diff --git a/progit/ui/fork.py b/progit/ui/fork.py
index d198691..f56a29b 100644
--- a/progit/ui/fork.py
+++ b/progit/ui/fork.py
@@ -139,6 +139,8 @@ def request_pull(repo, requestid, username=None):
             )
         )
 
+    form = progit.forms.ConfirmationForm()
+
     return flask.render_template(
         'pull_request.html',
         select='requests',
@@ -152,6 +154,7 @@ def request_pull(repo, requestid, username=None):
         diff_commits=diff_commits,
         diffs=diffs,
         html_diffs=html_diffs,
+        mergeform=form,
     )
 
 @APP.route('/<repo>/request-pull/<requestid>.patch')
@@ -286,6 +289,10 @@ def pull_request_add_comment(repo, requestid, commit, row, username=None):
 def merge_request_pull(repo, requestid, username=None):
     """ Request pulling the changes from the fork into the project.
     """
+
+    form = progit.forms.ConfirmationForm()
+    form.validate_on_submit()
+
     repo = progit.lib.get_project(SESSION, repo, user=username)
 
     if not repo:
@@ -383,11 +390,17 @@ def merge_request_pull(repo, requestid, username=None):
     return flask.redirect(flask.url_for('view_repo', repo=repo.name))
 
 
-@APP.route('/<repo>/request-pull/cancel/<requestid>')
-@APP.route('/fork/<username>/<repo>/request-pull/cancel/<requestid>')
+@APP.route('/<repo>/request-pull/cancel/<requestid>',
+        methods=('GET', 'POST'))
+@APP.route('/fork/<username>/<repo>/request-pull/cancel/<requestid>',
+        methods=('GET', 'POST'))
 def cancel_request_pull(repo, requestid, username=None):
     """ Cancel request pulling request.
     """
+
+    form = progit.forms.ConfirmationForm()
+    form.validate_on_submit()
+
     repo = progit.lib.get_project(SESSION, repo, user=username)
 
     if not repo: