From 7077adc475119dd854bf82a3cce4aa5f3ac4b813 Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Thu, 17 Nov 2022 21:40:40 -0800
Subject: [PATCH] ipn/localapi: require POST to add a bugreport marker

The LocalClient.BugReport method already sends it via POST.

Updates tailscale/corp#7948

Change-Id: I98dbd558c99d4296d934baa5ebc97052c7413073
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
(cherry picked from commit a13753ae1eb4a24ed39873a6b4ffca3d3376505b)
---
 ipn/localapi/localapi.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ipn/localapi/localapi.go b/ipn/localapi/localapi.go
index 20353674d..4fc2c744b 100644
--- a/ipn/localapi/localapi.go
+++ b/ipn/localapi/localapi.go
@@ -268,6 +268,10 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bugreport access denied", http.StatusForbidden)
 		return
 	}
+	if r.Method != "POST" {
+		http.Error(w, "only POST allowed", http.StatusMethodNotAllowed)
+		return
+	}
 
 	logMarker := func() string {
 		return fmt.Sprintf("BUG-%v-%v-%v", h.backendLogID, time.Now().UTC().Format("20060102150405Z"), randHex(8))