Mercurial > p > roundup > code
comparison roundup/rest.py @ 5730:4aa26a9f3b47
Tighten up use of X-HTTP-Method-Override to only work with POST.
Old method allowed PUT, DELETE .. to tunnel. Now I have no clue why
you would tunnel DELETE or PATCH in PUT but...
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sat, 25 May 2019 14:33:07 -0400 |
| parents | 9ea2ce9d10cf |
| children | 058ef18af5fd |
comparison
equal
deleted
inserted
replaced
| 5729:9ea2ce9d10cf | 5730:4aa26a9f3b47 |
|---|---|
| 1639 # Never allow GET to be an unsafe operation (i.e. data changing). | 1639 # Never allow GET to be an unsafe operation (i.e. data changing). |
| 1640 # User must use POST to "tunnel" DELETE, PUT, OPTIONS etc. | 1640 # User must use POST to "tunnel" DELETE, PUT, OPTIONS etc. |
| 1641 override = headers.get('X-HTTP-Method-Override') | 1641 override = headers.get('X-HTTP-Method-Override') |
| 1642 output = None | 1642 output = None |
| 1643 if override: | 1643 if override: |
| 1644 if method.upper() != 'GET': | 1644 if method.upper() == 'POST': |
| 1645 logger.debug( | 1645 logger.debug( |
| 1646 'Method overridden from %s to %s', method, override) | 1646 'Method overridden from %s to %s', method, override) |
| 1647 method = override | 1647 method = override |
| 1648 else: | 1648 else: |
| 1649 output = self.error_obj(400, | 1649 output = self.error_obj(400, |
| 1650 "X-HTTP-Method-Override: %s can not be used with GET method. Use Post instead." % override) | 1650 "X-HTTP-Method-Override: %s must be used with " |
| 1651 "POST method not %s."% (override, method.upper())) | |
| 1651 logger.info( | 1652 logger.info( |
| 1652 'Ignoring X-HTTP-Method-Override for GET request on %s', | 1653 'Ignoring X-HTTP-Method-Override using %s request on %s', |
| 1653 uri) | 1654 method.upper(), uri) |
| 1655 | |
| 1654 | 1656 |
| 1655 # parse Accept header and get the content type | 1657 # parse Accept header and get the content type |
| 1656 accept_header = parse_accept_header(headers.get('Accept')) | 1658 accept_header = parse_accept_header(headers.get('Accept')) |
| 1657 accept_type = "invalid" | 1659 accept_type = "invalid" |
| 1658 for part in accept_header: | 1660 for part in accept_header: |