romshark / datapages / 37054565778

push

github

fix: Refuse plain forms on App page cache actions

Require the Datastar-Request header on every action of App that takes
a datapages.PageCacheWriter, as on a page. A plain form cannot receive
the queued writes of a redirect: it gets an HTTP redirect,
which carries none. Take this action:

    // POSTReset is /reset
    func (*App) POSTReset(
        r *http.Request, pageCache datapages.PageCacheWriter,
    ) (redirect datapages.Redirect, err error) {
        pageCache.ClearAll()
        return datapages.Redirect{URL: "/"}, nil
    }

A <form method="post" action="/reset/"> gets a 302 to /, and the
worker keeps every cached page. Answer it with 406 Not Acceptable, as
for the same method on a page. Refuse a plain form to an action that
returns a body too, which keeps one rule for every action that takes
a datapages.PageCacheWriter.

4 of 5 new or added lines in 3 files covered. (80.0%)

14725 of 36335 relevant lines covered (40.53%)

544.07 hits per line