update: 让WhaleFilter支持form的hidden项

nutzam · Sep 17, 2024 · 56ad4cc · 56ad4cc
1 parent c425ef4
commit 56ad4cc
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 18 deletions.
diff --git a/doc/manual/mvc/whale_filter.man b/doc/manual/mvc/whale_filter.man
@@ -68,7 +68,15 @@ http方法隐式声明
 		...
 	</form>
 	}}}
-
+
+	或者直接把这个字段放到 form 的 hidden 里面
+
+	{{{<html>
+	<form action="/admin/topic/23" method="post">
+		<input type="hidden" name="_method" value="delete" />
+	</form>
+	}}}
+
 	对应这样的入口方法
 
 	{{{<JAVA>
@@ -86,8 +94,10 @@ http方法隐式声明
 	http.hidden_method_param=_method
 	}}}
 
+	对应的value仅支持「PUT」、「DELETE」、「PATCH」（不区分大小写），除此之外将会无效.
+
 	顺带说一下, 还有一种方式, "X-HTTP-Method-Override", 可通过下面的配置开启.
 
 	{{{
 	http.method_override=true
-	}}}
+	}}}
diff --git a/src/org/nutz/mvc/WhaleFilter.java b/src/org/nutz/mvc/WhaleFilter.java
@@ -3,13 +3,13 @@
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.StringReader;
-import java.nio.charset.Charset;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.Enumeration;
 import java.util.Iterator;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
@@ -30,7 +30,6 @@
 import org.nutz.lang.Lang;
 import org.nutz.lang.Mirror;
 import org.nutz.lang.Strings;
-import org.nutz.lang.util.NutMap;
 import org.nutz.log.LogAdapter;
 import org.nutz.log.Logs;
 import org.nutz.mvc.upload.FastUploading;
@@ -49,6 +48,7 @@ public class WhaleFilter implements Filter {
     private static WhaleFilter _me;
     protected ServletContext sc;
     protected Object uc;
+    private static final List<String> ALLOWED_METHODS = Collections.unmodifiableList(Arrays.asList("PUT", "DELETE", "PATCH"));
 
     public static WhaleFilter me() {
         return _me;
@@ -134,29 +134,29 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
         // 设置resp的编码
         if (outputEnc != null)
             resp.setCharacterEncoding(outputEnc);
-
         // 如果是POST请求,有很多可以hack的东西
         if ("POST".equals(req.getMethod())) {
+            String methodValue = null;
             // 处理隐藏HTTP METHOD, _method参数模式
             if (methodParam != null) {
-                String qs = req.getQueryString();
-                if (qs != null && qs.contains("_method=")) {
-                    final NutMap map = Mvcs.toParamMap(new StringReader(qs), inputEnc == null ? Charset.defaultCharset().name() : inputEnc);
+                methodValue = req.getParameter(methodParam);
+            }
+            // 处理 X-HTTP-Method-Override
+            else if (allowHTTPMethodOverride) {
+                methodValue = req.getHeader("X-HTTP-Method-Override");
+            }
+
+            // 取得到method的值的时候进行处理
+            if (!Strings.isEmpty(methodValue)) {
+                String method = methodValue.toUpperCase(Locale.ENGLISH);
+                if (ALLOWED_METHODS.contains(method)) {
                     request = new HttpServletRequestWrapper(req) {
                         public String getMethod() {
-                            return map.getString(methodParam);
+                            return method;
                         }
                     };
                 }
             }
-            // 处理 X-HTTP-Method-Override
-            else if (allowHTTPMethodOverride && req.getHeader("X-HTTP-Method-Override") != null) {
-                request = new HttpServletRequestWrapper(req) {
-                    public String getMethod() {
-                        return req.getHeader("X-HTTP-Method-Override");
-                    }
-                };
-            }
 
             // 处理文件上传
             String contentType = req.getContentType();