Skip to content

Commit 7065a22

Browse files
vedranmileticMarin Martuslović
authored and
bukka
committed
Respond with HTTP status 405 to DELETE/PUT/PATCH request on a static resource
Co-authored-by: Marin Martuslović <[email protected]>
1 parent 4f50905 commit 7065a22

File tree

2 files changed

+102
-0
lines changed

2 files changed

+102
-0
lines changed

‎sapi/cli/php_cli_server.c

+16
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ typedef struct php_cli_server_http_response_status_code_pair {
202202
static php_cli_server_http_response_status_code_pair template_map[] = {
203203
{ 400, "<h1>%s</h1><p>Your browser sent a request that this server could not understand.</p>" },
204204
{ 404, "<h1>%s</h1><p>The requested resource <code class=\"url\">%s</code> was not found on this server.</p>" },
205+
{ 405, "<h1>%s</h1><p>Requested method not allowed.</p>" },
205206
{ 500, "<h1>%s</h1><p>The server is temporarily unavailable.</p>" },
206207
{ 501, "<h1>%s</h1><p>Request method not supported.</p>" }
207208
};
@@ -2040,6 +2041,15 @@ static zend_result php_cli_server_send_error_page(php_cli_server *server, php_cl
20402041
smart_str_appends_ex(&buffer, "Content-Length: ", 1);
20412042
smart_str_append_unsigned_ex(&buffer, php_cli_server_buffer_size(&client->content_sender.buffer), 1);
20422043
smart_str_appendl_ex(&buffer, "\r\n", 2, 1);
2044+
if (status == 405) {
2045+
smart_str_appends_ex(&buffer, "Allow: ", 1);
2046+
smart_str_appends_ex(&buffer, php_http_method_str(PHP_HTTP_GET), 1);
2047+
smart_str_appends_ex(&buffer, ", ", 1);
2048+
smart_str_appends_ex(&buffer, php_http_method_str(PHP_HTTP_HEAD), 1);
2049+
smart_str_appends_ex(&buffer, ", ", 1);
2050+
smart_str_appends_ex(&buffer, php_http_method_str(PHP_HTTP_POST), 1);
2051+
smart_str_appendl_ex(&buffer, "\r\n", 2, 1);
2052+
}
20432053
smart_str_appendl_ex(&buffer, "\r\n", 2, 1);
20442054

20452055
chunk = php_cli_server_chunk_heap_new(buffer.s, ZSTR_VAL(buffer.s), ZSTR_LEN(buffer.s));
@@ -2094,6 +2104,12 @@ static zend_result php_cli_server_begin_send_static(php_cli_server *server, php_
20942104
int fd;
20952105
int status = 200;
20962106

2107+
if (client->request.request_method == PHP_HTTP_DELETE
2108+
|| client->request.request_method == PHP_HTTP_PUT
2109+
|| client->request.request_method == PHP_HTTP_PATCH) {
2110+
return php_cli_server_send_error_page(server, client, 405);
2111+
}
2112+
20972113
if (client->request.path_translated && strlen(client->request.path_translated) != client->request.path_translated_len) {
20982114
/* can't handle paths that contain nul bytes */
20992115
return php_cli_server_send_error_page(server, client, 400);

‎sapi/cli/tests/php_cli_server_013.phpt

+86
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,60 @@ HEAD /main/foo/bar HTTP/1.1
5858
Host: {$host}
5959
6060
61+
HEADER
62+
)) {
63+
while (!feof($fp)) {
64+
$output .= fgets($fp);
65+
}
66+
}
67+
68+
echo preg_replace("/<style>(.*?)<\/style>/s", "<style>AAA</style>", $output), "\n";
69+
fclose($fp);
70+
71+
$output = '';
72+
$fp = php_cli_server_connect();
73+
74+
if(fwrite($fp, <<<HEADER
75+
DELETE / HTTP/1.1
76+
Host: {$host}
77+
78+
79+
HEADER
80+
)) {
81+
while (!feof($fp)) {
82+
$output .= fgets($fp);
83+
}
84+
}
85+
86+
echo preg_replace("/<style>(.*?)<\/style>/s", "<style>AAA</style>", $output), "\n";
87+
fclose($fp);
88+
89+
$output = '';
90+
$fp = php_cli_server_connect();
91+
92+
if(fwrite($fp, <<<HEADER
93+
PUT / HTTP/1.1
94+
Host: {$host}
95+
96+
97+
HEADER
98+
)) {
99+
while (!feof($fp)) {
100+
$output .= fgets($fp);
101+
}
102+
}
103+
104+
echo preg_replace("/<style>(.*?)<\/style>/s", "<style>AAA</style>", $output), "\n";
105+
fclose($fp);
106+
107+
$output = '';
108+
$fp = php_cli_server_connect();
109+
110+
if(fwrite($fp, <<<HEADER
111+
PATCH / HTTP/1.1
112+
Host: {$host}
113+
114+
61115
HEADER
62116
)) {
63117
while (!feof($fp)) {
@@ -93,3 +147,35 @@ Date: %s
93147
Connection: close
94148
Content-Type: text/html; charset=UTF-8
95149
Content-Length: %d
150+
151+
152+
HTTP/1.1 405 Method Not Allowed
153+
Host: %s
154+
Date: %s
155+
Connection: close
156+
Content-Type: text/html; charset=UTF-8
157+
Content-Length: %d
158+
Allow: GET, HEAD, POST
159+
160+
<!doctype html><html><head><title>405 Method Not Allowed</title><style>AAA</style>
161+
</head><body><h1>Method Not Allowed</h1><p>Requested method not allowed.</p></body></html>
162+
HTTP/1.1 405 Method Not Allowed
163+
Host: %s
164+
Date: %s
165+
Connection: close
166+
Content-Type: text/html; charset=UTF-8
167+
Content-Length: %d
168+
Allow: GET, HEAD, POST
169+
170+
<!doctype html><html><head><title>405 Method Not Allowed</title><style>AAA</style>
171+
</head><body><h1>Method Not Allowed</h1><p>Requested method not allowed.</p></body></html>
172+
HTTP/1.1 405 Method Not Allowed
173+
Host: %s
174+
Date: %s
175+
Connection: close
176+
Content-Type: text/html; charset=UTF-8
177+
Content-Length: %d
178+
Allow: GET, HEAD, POST
179+
180+
<!doctype html><html><head><title>405 Method Not Allowed</title><style>AAA</style>
181+
</head><body><h1>Method Not Allowed</h1><p>Requested method not allowed.</p></body></html>

0 commit comments

Comments
 (0)