diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md index 2387aa3..ae05cca 100644 --- a/framework/CHANGELOG.md +++ b/framework/CHANGELOG.md @@ -4,6 +4,7 @@ Yii Framework 2 Change Log 2.1.0 under development ----------------------- +- Bug #14458: Fixed `yii\filters\VerbFilter` uses case-insensitive comparison for the HTTP method name (klimov-paul) - Enh #879: Caching implementation refactored according to PSR-16 'Simple Cache' specification (klimov-paul) - Enh #11328: Added support for PSR-7 'HTTP Message' (klimov-paul) - Enh #13799: CAPTCHA rendering logic extracted into `yii\captcha\DriverInterface`, which instance is available via `yii\captcha\CaptchaAction::$driver` field (vladis84, klimov-paul) diff --git a/framework/filters/VerbFilter.php b/framework/filters/VerbFilter.php index 6f663e2..212ca23 100644 --- a/framework/filters/VerbFilter.php +++ b/framework/filters/VerbFilter.php @@ -89,15 +89,14 @@ class VerbFilter extends Behavior { $action = $event->action->id; if (isset($this->actions[$action])) { - $verbs = $this->actions[$action]; + $allowed = $this->actions[$action]; } elseif (isset($this->actions['*'])) { - $verbs = $this->actions['*']; + $allowed = $this->actions['*']; } else { return $event->isValid; } $verb = Yii::$app->getRequest()->getMethod(); - $allowed = array_map('strtoupper', $verbs); if (!in_array($verb, $allowed)) { $event->isValid = false; // https://tools.ietf.org/html/rfc2616#section-14.7 diff --git a/tests/framework/filters/VerbFilterTest.php b/tests/framework/filters/VerbFilterTest.php new file mode 100644 index 0000000..81a1488 --- /dev/null +++ b/tests/framework/filters/VerbFilterTest.php @@ -0,0 +1,65 @@ +mockWebApplication(); + } + + public function testFilter() + { + $request = new Request(); + $this->mockWebApplication([ + 'components' => [ + 'request' => $request + ], + ]); + $controller = new Controller('id', Yii::$app); + $action = new Action('test', $controller); + $filter = new VerbFilter([ + 'actions' => [ + '*' => ['GET', 'POST', 'Custom'], + ] + ]); + + $event = new ActionEvent($action); + + $request->setMethod('GET'); + $this->assertTrue($filter->beforeAction($event)); + + $request->setMethod('CUSTOM'); + + try { + $filter->beforeAction($event); + } catch (MethodNotAllowedHttpException $exception) { + } + + $this->assertTrue(isset($exception)); + $this->assertEquals(['GET, POST, Custom'], Yii::$app->response->getHeader('Allow')); + } +} \ No newline at end of file