From a0ef4eae4dba63f720a62a1ae6bb413ea13736a5 Mon Sep 17 00:00:00 2001
From: Joe Nelson <cred+github@begriffs.com>
Date: Mon, 1 Feb 2016 22:52:57 -0800
Subject: [PATCH] Issue http 405 for anything but POST on RPC

Fixes #481
---
 CHANGELOG.md                | 5 +++++
 src/PostgREST/ApiRequest.hs | 3 ++-
 src/PostgREST/App.hs        | 4 +++-
 test/Feature/QuerySpec.hs   | 3 +++
 4 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f136280c..fcfdc8eef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,11 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## Unreleased
+
+### Fixed
+- Reject non-POSTs to rpc endpoints - @begriffs
+
 ## [0.3.0.3] - 2016-01-08
 
 ### Fixed
diff --git a/src/PostgREST/ApiRequest.hs b/src/PostgREST/ApiRequest.hs
index 958473d47..3fb3b05e3 100644
--- a/src/PostgREST/ApiRequest.hs
+++ b/src/PostgREST/ApiRequest.hs
@@ -31,6 +31,7 @@ data Action = ActionCreate | ActionRead
             | ActionUnknown BS.ByteString deriving Eq
 -- | The target db object of a user action
 data Target = TargetIdent QualifiedIdentifier
+            | TargetProc  QualifiedIdentifier
             | TargetRoot
             | TargetUnknown [T.Text]
 -- | How to return the inserted data
@@ -90,7 +91,7 @@ userApiRequest schema req reqBody =
                  []            -> TargetRoot
                  [table]       -> TargetIdent
                                   $ QualifiedIdentifier schema table
-                 ["rpc", proc] -> TargetIdent
+                 ["rpc", proc] -> TargetProc
                                   $ QualifiedIdentifier schema proc
                  other         -> TargetUnknown other
       payload = case pickContentType (lookupHeader "content-type") of
diff --git a/src/PostgREST/App.hs b/src/PostgREST/App.hs
index dd589c730..60e56aff8 100644
--- a/src/PostgREST/App.hs
+++ b/src/PostgREST/App.hs
@@ -155,7 +155,7 @@ app dbStructure conf reqBody req =
           filterCol _ _ _ =  False
       return $ responseLBS status200 [jsonH, allOrigins] $ cs body
 
-    (ActionInvoke, TargetIdent qi,
+    (ActionInvoke, TargetProc qi,
      Just (PayloadJSON (UniformObjects payload))) -> do
       exists <- H.query qi doesProcExist
       if exists
@@ -178,6 +178,8 @@ app dbStructure conf reqBody req =
 
     (ActionUnknown _, _, _) -> return notFound
 
+    (_, TargetProc _, _) -> return $ responseLBS status405 [] ""
+
     (_, TargetUnknown _, _) -> return notFound
 
     (_, _, Just (PayloadParseError e)) ->
diff --git a/test/Feature/QuerySpec.hs b/test/Feature/QuerySpec.hs
index 4de2b6061..e6928440b 100644
--- a/test/Feature/QuerySpec.hs
+++ b/test/Feature/QuerySpec.hs
@@ -386,6 +386,9 @@ spec struct c = around (withApp cfgDefault struct c) $ do
         post "/rpc/sayhello" [json| { "name": "world" } |] `shouldRespondWith`
           [json| [{"sayhello":"Hello, world"}] |]
 
+    it "currently supports POST only" $
+      get "/rpc/fake" `shouldRespondWith` 405 -- method not allowed
+
   describe "weird requests" $ do
     it "can query as normal" $ do
       get "/Escap3e;" `shouldRespondWith`