only allow methods which implement HTTP verbs to be called remotely
This fixes 500 server crashes caused by requests such as: curl -X__init__ "http://your-swift-object-server:6000/sda1/p/a/c/o" Fixes bug 1005903 Change-Id: I6c0ad39a29e07ce5f46b0fdbd11a53a9a1010a04
This commit is contained in:
@@ -53,7 +53,7 @@ from webob import Request, Response
|
||||
|
||||
from swift.common.ring import Ring
|
||||
from swift.common.utils import cache_from_env, ContextPool, get_logger, \
|
||||
get_remote_client, normalize_timestamp, split_path, TRUE_VALUES
|
||||
get_remote_client, normalize_timestamp, split_path, TRUE_VALUES, public
|
||||
from swift.common.bufferedhttp import http_connect
|
||||
from swift.common.constraints import check_metadata, check_object_creation, \
|
||||
check_utf8, CONTAINER_LISTING_LIMIT, MAX_ACCOUNT_NAME_LENGTH, \
|
||||
@@ -86,21 +86,6 @@ def update_headers(response, headers):
|
||||
response.headers[name] = value
|
||||
|
||||
|
||||
def public(func):
|
||||
"""
|
||||
Decorator to declare which methods are publicly accessible as HTTP
|
||||
requests
|
||||
|
||||
:param func: function to make public
|
||||
"""
|
||||
func.publicly_accessible = True
|
||||
|
||||
@functools.wraps(func)
|
||||
def wrapped(*a, **kw):
|
||||
return func(*a, **kw)
|
||||
return wrapped
|
||||
|
||||
|
||||
def delay_denial(func):
|
||||
"""
|
||||
Decorator to declare which methods should have any swift.authorize call
|
||||
@@ -2022,11 +2007,8 @@ class BaseApplication(object):
|
||||
self.logger.client_ip = get_remote_client(req)
|
||||
try:
|
||||
handler = getattr(controller, req.method)
|
||||
if not getattr(handler, 'publicly_accessible'):
|
||||
handler = None
|
||||
getattr(handler, 'publicly_accessible')
|
||||
except AttributeError:
|
||||
handler = None
|
||||
if not handler:
|
||||
self.logger.increment('method_not_allowed')
|
||||
return HTTPMethodNotAllowed(request=req)
|
||||
if path_parts['version']:
|
||||
|
||||
Reference in New Issue
Block a user