From a13753ae1eb4a24ed39873a6b4ffca3d3376505b Mon Sep 17 00:00:00 2001 From: Brad Fitzpatrick Date: Thu, 17 Nov 2022 21:40:40 -0800 Subject: [PATCH] ipn/localapi: require POST to add a bugreport marker The LocalClient.BugReport method already sends it via POST. Updates tailscale/corp#7948 Change-Id: I98dbd558c99d4296d934baa5ebc97052c7413073 Signed-off-by: Brad Fitzpatrick --- ipn/localapi/localapi.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ipn/localapi/localapi.go b/ipn/localapi/localapi.go index db59c777d..700be77f1 100644 --- a/ipn/localapi/localapi.go +++ b/ipn/localapi/localapi.go @@ -276,6 +276,10 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) { http.Error(w, "bugreport access denied", http.StatusForbidden) return } + if r.Method != "POST" { + http.Error(w, "only POST allowed", http.StatusMethodNotAllowed) + return + } logMarker := func() string { return fmt.Sprintf("BUG-%v-%v-%v", h.backendLogID, time.Now().UTC().Format("20060102150405Z"), randHex(8))