Kota Tsuyuzaki 4336ff4f99 Deny all access to controller instance method ... Current swift3 middleware can allow to access the controller instance method via HTTP verb and it may have a risk to be attacked like brute force. likely: from boto.s3.connection import S3Connection conn = S3Connection(<snip>) # expected 405 Method Not Allowed but this results in 500 # InternalError conn.make_request('_delete_segments_bucket', 'bucket') Probably all instance method except public verb like ones don't work well and nothing leaked but it will absolutely 500 InternalError without any information. This is worse. Thus we should strict the method anyway. This patch fixes it to set swift.common.utils.public decorator for all public methods and then middleware will deny the accesses for non-public methods. Closes-Bug: #1592250 Change-Id: Ia5579011701eaff2bca555efe950b0c11a3ff5b9		2016-06-14 19:04:14 -07:00
..
functional	Deny all access to controller instance method	2016-06-14 19:04:14 -07:00
unit	Deny all access to controller instance method	2016-06-14 19:04:14 -07:00
__init__.py	test: add FakeSwift	2014-06-05 10:24:38 +09:00