Merge lp:~leonardr/lazr.restful/ignore-x-http-method-override-on-non-post into lp:lazr.restful

[Leonard Richardson]

This branch fixes bug 423149 by ignoring the X-HTTP-Method-Override header unless the incoming request is a POST request. See that bug for analysis.

[lp:~leonardr/lazr.restful/ignore-x-http-method-override-on-non-post]

160. By Leonard Richardson on 2011-01-19

Merge from trunk.

[Tim Penhey (thumper)]

Looks good to me.

review: Approve

=== modified file 'src/lazr/restful/NEWS.txt'
--- src/lazr/restful/NEWS.txt	2011-01-17 23:51:16 +0000
+++ src/lazr/restful/NEWS.txt	2011-01-19 18:29:09 +0000
@@ -2,12 +2,15 @@
 NEWS for lazr.restful
 =====================
 
-Unreleased
-==========
+0.15.1 (2010-01-19)
+===================
 
 Fixed a redirect bug when a web browser requests a representation
 other than JSON.
 
+Removed overzealous error checking that was causing problems for
+browsers such as Chromium. (Launchpad bug 423149.)
+
 0.15.0 (2010-11-30)
 ===================
 

=== modified file 'src/lazr/restful/_resource.py'
--- src/lazr/restful/_resource.py	2010-10-25 16:31:09 +0000
+++ src/lazr/restful/_resource.py	2011-01-19 18:29:09 +0000
@@ -216,9 +216,6 @@
     # A preparsed template file for WADL representations of resources.
     WADL_TEMPLATE = LazrPageTemplateFile('templates/wadl-resource.pt')
 
-    HTTP_METHOD_OVERRIDE_ERROR = ("X-HTTP-Method-Override can only be used "
-                                  "with a POST request.")
-
     # All resources serve WADL and JSON representations. Only entry
     # resources serve XHTML representations.
     SUPPORTED_CONTENT_TYPES = [WADL_TYPE, DEPRECATED_WADL_TYPE, JSON_TYPE]
@@ -238,20 +235,15 @@
         This is usually the actual HTTP method, but it might be
         overridden by a value for X-HTTP-Method-Override.
 
-        :return: None if the valid for X-HTTP-Method-Override is invalid.
-        Otherwise, the HTTP method to use.
+        :return: The HTTP method to use.
         """
         if request == None:
             request = self.request
         override = request.headers.get('X-HTTP-Method-Override')
-        if override is not None:
-            if request.method == 'POST':
-                return override
-            else:
-                # XHMO should not be used unless the underlying method
-                # is POST.
-                self.request.response.setStatus(400)
-                return None
+        if override is not None and request.method == 'POST':
+            # POST is the only HTTP method for which we respect
+            # X-HTTP-Method-Override.
+            return override
         return request.method
 
     def handleConditionalGET(self):
@@ -863,9 +855,7 @@
         """Handle a GET or (if implemented) POST request."""
         result = ""
         method = self.getRequestMethod()
-        if method is None:
-            result = self.HTTP_METHOD_OVERRIDE_ERROR
-        elif method == "GET":
+        if method == "GET":
             result = self.do_GET()
         elif method == "POST" and self.implementsPOST():
             result = self.do_POST()
@@ -893,9 +883,7 @@
         result = ""
         method = self.getRequestMethod()
         try:
-            if method is None:
-                result = self.HTTP_METHOD_OVERRIDE_ERROR
-            elif method == "GET":
+            if method == "GET":
                 result = self.do_GET()
             elif method in ["PUT", "PATCH"]:
                 media_type = self.handleConditionalWrite()
@@ -1799,9 +1787,7 @@
     def __call__(self, REQUEST=None):
         """Handle a GET request."""
         method = self.getRequestMethod(REQUEST)
-        if method is None:
-            result = self.HTTP_METHOD_OVERRIDE_ERROR
-        elif method == "GET":
+        if method == "GET":
             result = self.do_GET()
         else:
             REQUEST.response.setStatus(405)

=== modified file 'src/lazr/restful/example/base/tests/entry.txt'
--- src/lazr/restful/example/base/tests/entry.txt	2010-10-25 16:31:09 +0000
+++ src/lazr/restful/example/base/tests/entry.txt	2011-01-19 18:29:09 +0000
@@ -404,14 +404,25 @@
     HTTP/1.1 209 Content Returned
     ...
 
-If you try to use X-HTTP-Method-Override when the underlying HTTP
-method is not POST, you'll get an error.
+Here, the use of a nonexistent HTTP method causes an error.
 
     >>> print modify_cookbook('Everyday Greens',
-    ...     {}, 'GET', {'X-HTTP-Method-Override' : 'PATCH'})
-    HTTP/1.1 400 Bad Request
-    ...
-    X-HTTP-Method-Override can only be used with a POST request.
+    ...     {'cuisine' : 'General'}, 'POST',
+    ...     {'X-HTTP-Method-Override' : 'NOSUCHMETHOD'})
+    HTTP/1.1 405 Method Not Allowed
+    ...
+
+X-HTTP-Method-Override is only respected when the underlying HTTP
+method is POST. If you use X-HTTP-Method-Override with any other HTTP
+method, your value is ignored. Here, a nonexistent HTTP method is
+ignored in favor of HTTP GET.
+
+    >>> print webservice('/cookbooks/Everyday%20Greens', 'GET',
+    ...     headers={'X-HTTP-Method-Override' : 'NOSUCHMETHOD'})
+    HTTP/1.1 200 Ok
+    ...
+    Content-Type: application/json
+    ...
 
 Even if a client supports PATCH, sometimes it's easier to GET a
 document, modify it, and send it back. If you have the full document