sql_browser: check request method

0dd3a069 · Jérome Perrin · Kazuhiko Shiozaki · 6f09ba28 · 0dd3a069
Commit 0dd3a069 authored Feb 09, 2024 by Jérome Perrin Committed by Kazuhiko Shiozaki Jul 11, 2024
Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 1 deletion

bt5/erp5_sql_browser/SkinTemplateItem/portal_skins/erp5_sql_browser/ZMySQLDAConnection_getQueryResultAsJSON.py ...p5_sql_browser/ZMySQLDAConnection_getQueryResultAsJSON.py +6 -1

No files found.
--- a/bt5/erp5_sql_browser/SkinTemplateItem/portal_skins/erp5_sql_browser/ZMySQLDAConnection_getQueryResultAsJSON.py
+++ b/bt5/erp5_sql_browser/SkinTemplateItem/portal_skins/erp5_sql_browser/ZMySQLDAConnection_getQueryResultAsJSON.py
@@ -5,7 +5,12 @@ import json
 from DateTime import DateTime
 import six

-response = container.REQUEST.RESPONSE
+request = container.REQUEST
+if request['REQUEST_METHOD'] != 'POST':
+  from zExceptions import BadRequest
+  raise BadRequest
+
+response = request.RESPONSE
 start = time.time()
 try:
  results = context.manage_test(query)