[api] don't block /lastevents and /public/lastevent

Map public/lastevents and lastevents to the same function and map it
to a GET, which can be X-Forwarded

src/api/app/controllers/application_controller.rb

@@ -369,11 +369,7 @@ def pass_to_backend( path = nil )
 
     unless path
       path = request.path
-      if not request.query_string.blank?
-        path = path + '?'+request.query_string
-      elsif not request.env["rack.request.form_vars"].blank?
-        path = path + '?' + request.env["rack.request.form_vars"]
-      end
+      patch += build_query_from_hash(request.request_parameters.merge(request.query_parameters))
     end
 
     case request.method.to_s.downcase

src/api/app/controllers/public_controller.rb

@@ -125,17 +125,6 @@ def source_file
     end
   end
 
-  # GET /public/lastevents
-  def lastevents
-    path = unshift_public(request.path)
-    if not request.query_string.blank?
-      path += "?#{request.query_string}" 
-    elsif not request.env["rack.request.form_vars"].blank?
-      path += "?#{request.env["rack.request.form_vars"]}" 
-    end
-    pass_to_backend path
-  end
-
   # GET /public/distributions
   def distributions
     @distributions = Distribution.all_as_hash

src/api/app/controllers/source_controller.rb

@@ -20,6 +20,7 @@ class IllegalRequestError < APIException
   validate_action :package_meta => {:method => :put, :request => :package, :response => :status}
 
   skip_before_filter :validate_xml_request, :only => [:file]
+  skip_before_filter :extract_user, only: [:lastevents_public]
 
   # /source
   #########
@@ -1198,15 +1199,19 @@ def file
     end
   end
 
+  # POST, GET /public/lastevents
   # GET /lastevents
+  def lastevents_public
+    lastevents
+  end
+
+  # POST /lastevents
   def lastevents
     path = request.path
-    if not request.query_string.blank?
-      path += "?#{request.query_string}"
-    elsif not request.env["rack.request.form_vars"].blank?
-      path += "?#{request.env["rack.request.form_vars"]}"
-    end
-    pass_to_backend path
+    path += build_query_from_hash(request.request_parameters.merge(request.query_parameters))
+
+    # map to a GET, so we can X-forward it
+    forward_from_backend path
   end
 
   private

src/api/config/routes.rb

@@ -256,8 +256,9 @@
 
     ### /lastevents
 
-    match '/lastevents' => 'public#lastevents', via: :get
-    match '/lastevents' => 'source#lastevents', via: :post
+    get '/lastevents' => 'source#lastevents_public'
+    match 'public/lastevents' => "source#lastevents_public", via: [:get, :post]
+    post '/lastevents' => 'source#lastevents'
 
     ### /distributions
 
@@ -282,7 +283,6 @@
       get 'public/source/:project/:package' => :package_index, :constraints => cons
       get 'public/source/:project/:package/_meta' => :package_meta, :constraints => cons
       get 'public/source/:project/:package/:filename' => :source_file, :constraints => cons
-      match 'public/lastevents' => :lastevents, via: [:get, :post]
       get 'public/distributions' => :distributions
       get 'public/binary_packages/:project/:package' => :binary_packages, :constraints => cons
     end