|
1 | 1 | /*
|
2 |
| - * Copyright 2002-2017 the original author or authors. |
| 2 | + * Copyright 2002-2018 the original author or authors. |
3 | 3 | *
|
4 | 4 | * Licensed under the Apache License, Version 2.0 (the "License");
|
5 | 5 | * you may not use this file except in compliance with the License.
|
|
16 | 16 |
|
17 | 17 | package org.springframework.web.filter.reactive;
|
18 | 18 |
|
| 19 | +import java.util.Arrays; |
| 20 | +import java.util.Collections; |
| 21 | +import java.util.List; |
19 | 22 | import java.util.Locale;
|
20 | 23 |
|
21 | 24 | import reactor.core.publisher.Mono;
|
|
45 | 48 | */
|
46 | 49 | public class HiddenHttpMethodFilter implements WebFilter {
|
47 | 50 |
|
| 51 | + private static final List<HttpMethod> ALLOWED_METHODS = |
| 52 | + Collections.unmodifiableList(Arrays.asList(HttpMethod.PUT, |
| 53 | + HttpMethod.DELETE, HttpMethod.PATCH)); |
| 54 | + |
48 | 55 | /** Default name of the form parameter with the HTTP method to use */
|
49 | 56 | public static final String DEFAULT_METHOD_PARAMETER_NAME = "_method";
|
50 | 57 |
|
@@ -87,7 +94,12 @@ public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
|
87 | 94 | private ServerWebExchange mapExchange(ServerWebExchange exchange, String methodParamValue) {
|
88 | 95 | HttpMethod httpMethod = HttpMethod.resolve(methodParamValue.toUpperCase(Locale.ENGLISH));
|
89 | 96 | Assert.notNull(httpMethod, () -> "HttpMethod '" + methodParamValue + "' not supported");
|
90 |
| - return exchange.mutate().request(builder -> builder.method(httpMethod)).build(); |
| 97 | + if (ALLOWED_METHODS.contains(httpMethod)) { |
| 98 | + return exchange.mutate().request(builder -> builder.method(httpMethod)).build(); |
| 99 | + } |
| 100 | + else { |
| 101 | + return exchange; |
| 102 | + } |
91 | 103 | }
|
92 | 104 |
|
93 | 105 | }
|
0 commit comments