Skip to content
Browse files

Restrict Request Method hacking with ?_method to POST requests. [Rick…

… Olson]

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@4644 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
  • Loading branch information...
1 parent c9417dc commit 58b996f9b03668573fef2696d583ff04191a5fa7 @technoweenie technoweenie committed Aug 1, 2006
Showing with 33 additions and 3 deletions.
  1. +2 −0 actionpack/CHANGELOG
  2. +2 −2 actionpack/lib/action_controller/request.rb
  3. +29 −1 actionpack/test/controller/request_test.rb
View
2 actionpack/CHANGELOG
@@ -1,5 +1,7 @@
*SVN*
+* Restrict Request Method hacking with ?_method to POST requests. [Rick Olson]
+
* Fix bug when passing multiple options to SimplyRestful, like :new => { :preview => :get, :draft => :get }. [Rick Olson, Josh Susser, Lars Pind]
* Dup the options passed to map.resources so that multiple resources get the same options. [Rick Olson]
View
4 actionpack/lib/action_controller/request.rb
@@ -15,8 +15,8 @@ def parameters
# Returns the HTTP request method as a lowercase symbol (:get, for example)
def method
- @request_method ||= (method = parameters[:_method] && method == :post) ?
- method.to_s.downcase.to_sym :
+ @request_method ||= (!parameters[:_method].blank? && @env['REQUEST_METHOD'] == 'POST') ?
+ parameters[:_method].to_s.downcase.to_sym :
@env['REQUEST_METHOD'].downcase.to_sym
end
View
30 actionpack/test/controller/request_test.rb
@@ -262,5 +262,33 @@ def test_reports_ssl_when_proxied_via_lighttpd
@request.env['HTTP_X_FORWARDED_PROTO'] = 'https'
assert @request.ssl?
end
-
+
+ def test_symbolized_request_methods
+ [:head, :get, :post, :put, :delete].each do |method|
+ set_request_method_to method
+ assert_equal method, @request.method
+ end
+ end
+
+ def test_allow_method_hacking_on_post
+ set_request_method_to :post
+ [:head, :get, :put, :delete].each do |method|
+ @request.instance_eval { @parameters = { :_method => method } ; @request_method = nil }
+ assert_equal method, @request.method
+ end
+ end
+
+ def test_restrict_method_hacking
+ @request.instance_eval { @parameters = { :_method => 'put' } }
+ [:head, :get, :put, :delete].each do |method|
+ set_request_method_to method
+ assert_equal method, @request.method
+ end
+ end
+
+ protected
+ def set_request_method_to(method)
+ @request.env['REQUEST_METHOD'] = method.to_s.upcase
+ @request.instance_eval { @request_method = nil }
+ end
end

0 comments on commit 58b996f

Please sign in to comment.
Something went wrong with that request. Please try again.