diff roundup/rest.py @ 5730:4aa26a9f3b47

Tighten up use of X-HTTP-Method-Override to only work with POST. Old method allowed PUT, DELETE .. to tunnel. Now I have no clue why you would tunnel DELETE or PATCH in PUT but...
author John Rouillard <rouilj@ieee.org>
date Sat, 25 May 2019 14:33:07 -0400
parents 9ea2ce9d10cf
children 058ef18af5fd
line wrap: on
line diff
--- a/roundup/rest.py	Sat May 25 14:23:16 2019 -0400
+++ b/roundup/rest.py	Sat May 25 14:33:07 2019 -0400
@@ -1641,16 +1641,18 @@
         override = headers.get('X-HTTP-Method-Override')
         output = None
         if override:
-            if method.upper() != 'GET':
+            if method.upper() == 'POST':
                 logger.debug(
                     'Method overridden from %s to %s', method, override)
                 method = override
             else:
                 output = self.error_obj(400,
-                               "X-HTTP-Method-Override: %s can not be used with GET method. Use Post instead." % override)
+                       "X-HTTP-Method-Override: %s must be used with "
+                       "POST method not %s."% (override, method.upper()))
                 logger.info(
-                    'Ignoring X-HTTP-Method-Override for GET request on %s',
-                    uri)
+                    'Ignoring X-HTTP-Method-Override using %s request on %s',
+                    method.upper(), uri)
+
 
         # parse Accept header and get the content type
         accept_header = parse_accept_header(headers.get('Accept'))

Roundup Issue Tracker: http://roundup-tracker.org/