1.1 --- a/framework/env/request/handler.lua	Mon Jul 25 22:49:40 2016 +0200
     1.2 +++ b/framework/env/request/handler.lua	Tue Jul 26 15:35:37 2016 +0200
     1.3 @@ -9,6 +9,7 @@
     1.4  --]]--
     1.5  
     1.6  function request.handler(http_request)
     1.7 +
     1.8    request._http_request = http_request
     1.9    local path = http_request.path
    1.10    if path then
    1.11 @@ -24,17 +25,36 @@
    1.12    else
    1.13      request._relative_baseurl = nil
    1.14    end
    1.15 -  request._route = request.router()
    1.16 -  do
    1.17 -    local post_id = http_request.post_params["_webmcp_id"]
    1.18 -    if post_id then
    1.19 -      request._route.id = post_id
    1.20 -    end
    1.21 -  end
    1.22  
    1.23    local success, error_info = xpcall(
    1.24      function()
    1.25  
    1.26 +      local function require_method(errmsg, ...)
    1.27 +        for i = 2, select("#", ...) do
    1.28 +          if http_request.method == select(i, ...) then return end
    1.29 +        end
    1.30 +        request.set_status("405 Method Not Allowed")
    1.31 +        request.add_header("Allow", table.concat({...}, ", "))
    1.32 +        error(errmsg)
    1.33 +      end
    1.34 +
    1.35 +      request._route = request.router()
    1.36 +      do
    1.37 +        local post_id = http_request.post_params["_webmcp_id"]
    1.38 +        if post_id then
    1.39 +          request._route.id = post_id
    1.40 +        end
    1.41 +      end
    1.42 +      local options_handler = loadcached(encode.file_path(
    1.43 +        WEBMCP_BASE_PATH, 'app', WEBMCP_APP_NAME, 'http_options.lua'
    1.44 +      ))
    1.45 +      if options_handler then
    1.46 +        options_handler()
    1.47 +      end
    1.48 +      if http_request.method == "OPTIONS" then
    1.49 +        return
    1.50 +      end
    1.51 +
    1.52        if not request._route then
    1.53          request._route = {}
    1.54          if request.get_404_route() then
    1.55 @@ -75,6 +95,10 @@
    1.56              error('Could not open static file "' .. subpath .. '": ' .. errmsg)
    1.57            end
    1.58          else
    1.59 +          require_method(
    1.60 +            "Invalid HTTP method for static file",
    1.61 +            "HEAD", "GET", "POST"
    1.62 +          )
    1.63            local d = assert(f:read("*a"))
    1.64            f:close()
    1.65            slot.put_into("data", d)
    1.66 @@ -111,11 +135,10 @@
    1.67            request.set_status("404 Not Found")
    1.68            request.forward(request.get_404_route())
    1.69          else
    1.70 -          if http_request.method ~= "POST" then
    1.71 -            request.set_status("405 Method Not Allowed")
    1.72 -            request.add_header("Allow", "POST")
    1.73 -            error("Tried to invoke an action with a GET request.")
    1.74 -          end
    1.75 +          require_method(
    1.76 +            "Invalid HTTP method for action (POST request required)",
    1.77 +            "POST"
    1.78 +          )
    1.79            local action_status = execute.filtered_action{
    1.80              module = request.get_module(),
    1.81              action = request.get_action(),
    1.82 @@ -183,6 +206,10 @@
    1.83          if string.find(view, "^_") then
    1.84            error("Tried to call a private view (prefixed with underscore).")
    1.85          end
    1.86 +        require_method(
    1.87 +          "Invalid HTTP method",
    1.88 +          "HEAD", "GET", "POST"
    1.89 +        )
    1.90          execute.filtered_view{
    1.91            module = request.get_module(),
    1.92            view   = view,