From 2ce080d36cb8dd0ac461513e5f6da86913cf2b06 Mon Sep 17 00:00:00 2001
From: Tim Simmons <tim.simmons@rackspace.com>
Date: Fri, 4 Mar 2016 10:03:04 -0600
Subject: [PATCH] Do not allow GET /resource.json

By _default_, Pecan exposes the functionality
to try and "use the extension in the URL for
guessing the content type to return."

I'm not even kidding:
http://pecan.readthedocs.org/en/latest/pecan_core.html#pecan.core.Pecan
`guess_content_type_from_ext`.

So this allowed an API user to GET /v2/zones.json that returned
the same thing as /v2/zones. Similarly for /zones/id.json.

So this turns that off.

Change-Id: I38a2e35f58cf7619bee64247d7ac01a50b0dcc58
---
 designate/api/v2/app.py                       | 3 ++-
 functionaltests/api/v2/clients/zone_client.py | 5 +++++
 functionaltests/api/v2/test_zone.py           | 4 ++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/designate/api/v2/app.py b/designate/api/v2/app.py
index 4464640cb..5601957ad 100644
--- a/designate/api/v2/app.py
+++ b/designate/api/v2/app.py
@@ -40,7 +40,8 @@ def setup_app(pecan_config):
         pecan_config.app.root,
         debug=getattr(pecan_config.app, 'debug', False),
         force_canonical=getattr(pecan_config.app, 'force_canonical', True),
-        request_cls=patches.Request
+        request_cls=patches.Request,
+        guess_content_type_from_ext=False
     )
 
     return app
diff --git a/functionaltests/api/v2/clients/zone_client.py b/functionaltests/api/v2/clients/zone_client.py
index 762fd3d1c..62707f4c9 100644
--- a/functionaltests/api/v2/clients/zone_client.py
+++ b/functionaltests/api/v2/clients/zone_client.py
@@ -75,3 +75,8 @@ class ZoneClient(ClientMixin):
         except NotFound:
             return True
         return False
+
+    def zones_dot_json(self, filters=None, **kwargs):
+        uri = self.create_uri("/zones.json", filters=filters)
+        resp, body = self.client.get(uri, **kwargs)
+        return self.deserialize(resp, body, ZoneListModel)
diff --git a/functionaltests/api/v2/test_zone.py b/functionaltests/api/v2/test_zone.py
index f96418419..fdfbc8c05 100644
--- a/functionaltests/api/v2/test_zone.py
+++ b/functionaltests/api/v2/test_zone.py
@@ -69,6 +69,10 @@ class ZoneTest(DesignateV2Test):
         self.assertEqual(202, resp.status)
         client.wait_for_zone_404(model.id)
 
+    def test_list_zones_dot_json_fails(self):
+        self.assertRaises(NotFound,
+            lambda: ZoneClient.as_user('default').zones_dot_json())
+
 
 class ZoneOwnershipTest(DesignateV2Test):