While I agree that you should include a one-time token with all sensitive forms, I don't think that disabling links/submit buttons on the first click is a bad idea in general. It's an easy fix that will immediately prevent most accidental redundant server requests, but as it's a client-side fix it's inherently unreliable.
What's wrong though is the author's solution of disabling _all_ links and submit buttons on the page indefinitely. Here's an alternative solution that only disables whatever has been clicked on for half a second:
(function() {
function stopClickEvent (ev) {
ev.preventDefault();
ev.stopPropagation();
}
document.body.addEventListener('click', function (ev) {
if (ev.target.tagName === 'A' || ev.target.getAttribute('type').toLowerCase() === 'submit') {
setTimeout(function () {
// Needs to happen _after_ the request goes through, hence the timeout
ev.target.addEventListener('click', stopClickEvent);
}, 0);
setTimeout(function () {
ev.target.removeEventListener('click', stopClickEvent);
}, 500);
}
});
})();