meteo/Sentri
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change all the forms from _method to X-HTTP-Method-Override fix

Browse Source
This commit is contained in:
Marco
2026-06-13 14:27:10 +02:00
parent 3b200d30cb
commit ec82b2add0
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pub/api/classes/API.php
View File

@@ -474,14 +474,20 @@ class API
$allowedMethods = ['GET', 'POST', 'PUT', 'DELETE']; $allowedMethods = ['GET', 'POST', 'PUT', 'DELETE'];
$method = $_SERVER['REQUEST_METHOD'] ?? ''; $method = $_SERVER['REQUEST_METHOD'] ?? '';
# The HTTP_X_HTTP_METHOD_OVERRIDE header is allowed for API requests because # The X-HTTP-Method-Override header is allowed for API requests because
# some web servers do not support PUT or DELETE methods by default. # some web servers do not support PUT or DELETE methods by default.
# This override is only applied when the request method is POST and the header is present. # This override is only applied when the request method is POST and the header is present.
if ($method === 'POST' && isset($_POST['X-HTTP-Method-Override'])) { if ($method === 'POST') {
$override = strtoupper($_POST['X-HTTP-Method-Override']); # $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] is from API calls
# $_POST['X-HTTP-Method-Override'] if from API calls from the frontend.
$override = $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] ?? $_POST['X-HTTP-Method-Override'] ?? null;
if (in_array($override, $allowedMethods, true)) { if (is_string($override)) {
$method = $override; $override = strtoupper($override);
if (in_array($override, $allowedMethods, true)) {
$method = $override;
}
} }
} }