Vote #74635
完了REST API POST and PUT broken
0%
説明
I could re-verify the behavior documented in #15424 for PUT requests. An update shows the same error message, as a POST request.
This effectively makes the REST API @read-only@.
The POST requests have been re-tested in 2.3.3, and there they do work!
journals
Adding the line
@skip_before_filter :verify_authenticity_token@
to the respective controller (e.g. for Users the file app/controllers/users_controller.rb) removes the problem. Wouldn't the correct solution be to verify the authenticity_token only in case of webbrowser based access?
--------------------------------------------------------------------------------
I could track down the changeset that seems to make the problem https://bitbucket.org/redmine/redmine-trunk/commits/b823653c220c8a7f32e321b39d0bdc5f85b4689f
--------------------------------------------------------------------------------
Removing lines 39-42 of above mentioned patch, makes POST and PUT usable again.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Fixed in r12311, a test with token verification turned _on_ (_off_ by default in tests) is now present. The fix will be included in 2.4.1 that will be released tomorrow. Thanks for pointing this out.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Merged.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
related_issues
relates,Closed,11797,Using the API logs out my browser session
duplicates,Closed,15453,Redmine-Java-API - POST/Put stopped working from android application
duplicates,Closed,15424,Filter chain halted as :verify_authenticity_token rendered or redirected