From a2066cbe4878ff084c9bf9d34a3fe424912e73e9 Mon Sep 17 00:00:00 2001
From: Carsten Brandt <mail@cebe.cc>
Date: Wed, 29 May 2013 04:24:38 +0200
Subject: [PATCH 1/2] Created a \yii\web\VerbFilter

It allows to filter actions by HTTP request methods
---
 framework/yii/web/VerbFilter.php | 90 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)
 create mode 100644 framework/yii/web/VerbFilter.php

diff --git a/framework/yii/web/VerbFilter.php b/framework/yii/web/VerbFilter.php
new file mode 100644
index 0000000..9b475e3
--- /dev/null
+++ b/framework/yii/web/VerbFilter.php
@@ -0,0 +1,90 @@
+<?php
+/**
+ * @link http://www.yiiframework.com/
+ * @copyright Copyright (c) 2008 Yii Software LLC
+ * @license http://www.yiiframework.com/license/
+ */
+
+namespace yii\web;
+
+use Yii;
+use yii\base\ActionEvent;
+use yii\base\Behavior;
+use yii\base\HttpException;
+
+/**
+ * VerbFilter is an action filter that filters by HTTP request methods.
+ *
+ * It allows to define allowed HTTP request methods for each action and will throw
+ * an HTTP 405 error when the method is not allowed.
+ *
+ * To use VerbFilter, declare it in the `behaviors()` method of your controller class.
+ * For example, the following declarations will define a typical set of allowed
+ * request methods for REST CRUD actions.
+ *
+ * ~~~
+ * public function behaviors()
+ * {
+ *     return array(
+ *         'verbs' => array(
+ *             'class' => \yii\web\VerbFilter::className(),
+ *             'actions' => array(
+ *                 'index'  => array('get'),
+ *                 'view'   => array('get'),
+ *                 'create' => array('get', 'post'),
+ *                 'update' => array('get', 'put', 'post'),
+ *                 'delete' => array('post', 'delete'),
+ *             ),
+ *         ),
+ *     );
+ * }
+ * ~~~
+ *
+ * @see http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.7
+ * @author Carsten Brandt <mail@cebe.cc>
+ * @since 2.0
+ */
+class VerbFilter extends Behavior
+{
+	/**
+	 * @var array this property defines the allowed request methods for each action.
+	 * For each action that should only support limited set of request methods
+	 * you add an entry with the action id as array key and an array of
+	 * allowed methods (e.g. GET, HEAD, PUT) as the value.
+	 * If an action is not listed all request methods are considered allowed.
+	 */
+	public $actions = array();
+
+
+	/**
+	 * Declares event handlers for the [[owner]]'s events.
+	 * @return array events (array keys) and the corresponding event handler methods (array values).
+	 */
+	public function events()
+	{
+		return array(
+			Controller::EVENT_BEFORE_ACTION => 'beforeAction',
+		);
+	}
+
+	/**
+	 * @param ActionEvent $event
+	 * @return boolean
+	 * @throws \yii\base\HttpException when the request method is not allowed.
+	 */
+	public function beforeAction($event)
+	{
+		$action = $event->action->id;
+		if (isset($this->actions[$action])) {
+			$verb = Yii::$app->getRequest()->getRequestMethod();
+			$allowed = array_map('strtoupper', $this->actions[$action]);
+			if (!in_array($verb, $allowed)) {
+				$event->isValid = false;
+				// http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.7
+				header('Allow: ' . implode(', ', $allowed));
+				throw new HttpException(405, 'Method Not Allowed. This url can only handle the following request methods: ' . implode(', ', $allowed));
+			}
+		}
+		return $event->isValid;
+	}
+}

From 9af5466be588bbaeb8a2d413d651a1698226861e Mon Sep 17 00:00:00 2001
From: Carsten Brandt <mail@cebe.cc>
Date: Wed, 29 May 2013 05:55:14 +0300
Subject: [PATCH 2/2] typo in Html helper

---
 framework/yii/helpers/base/Html.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/framework/yii/helpers/base/Html.php b/framework/yii/helpers/base/Html.php
index 90396ec..9a0001c 100644
--- a/framework/yii/helpers/base/Html.php
+++ b/framework/yii/helpers/base/Html.php
@@ -344,7 +344,7 @@ class Html
 	/**
 	 * Generates a hyperlink tag.
 	 * @param string $text link body. It will NOT be HTML-encoded. Therefore you can pass in HTML code
-	 * such as an image tag. If this is is coming from end users, you should consider [[encode()]]
+	 * such as an image tag. If this is coming from end users, you should consider [[encode()]]
 	 * it to prevent XSS attacks.
 	 * @param array|string|null $url the URL for the hyperlink tag. This parameter will be processed by [[url()]]
 	 * and will be used for the "href" attribute of the tag. If this parameter is null, the "href" attribute
@@ -366,7 +366,7 @@ class Html
 	/**
 	 * Generates a mailto hyperlink.
 	 * @param string $text link body. It will NOT be HTML-encoded. Therefore you can pass in HTML code
-	 * such as an image tag. If this is is coming from end users, you should consider [[encode()]]
+	 * such as an image tag. If this is coming from end users, you should consider [[encode()]]
 	 * it to prevent XSS attacks.
 	 * @param string $email email address. If this is null, the first parameter (link body) will be treated
 	 * as the email address and used.