tags:

views:

21

answers:

1

Hi,

this action is generated in symfony 1.2 when you create a module:

public function executeUpdate(sfWebRequest $request) {
    $this->forward404Unless($request->isMethod('post') || $request->isMethod('put'));
    $this->forward404Unless($usuario = Doctrine::getTable('Usuario')->find(array($request->getParameter('id'))), sprintf('Object usuario does not exist (%s).', $request->getParameter('id')));
    $this->form = new UsuarioForm($usuario);

    $this->processForm($request, $this->form);

    $this->setTemplate('edit');
}

Can some explain the line?:

$this->forward404Unless($request->isMethod('post') || $request->isMethod('put'));

I don't know the reason why it is there.

Regards

Javi

+1  A: 

The line says if the user just clicked "submit" on the form and a POST request was made.

Without it, people can browse to that action without sending any data.

I would recommend you remove the || $request->isMethod('put') part though -- nobody uses PUT.

Coronatus
Correct answer, apart from the last sentence - people use PUT as part of a RESTful architecture quite frequently: http://en.wikipedia.org/wiki/Representational_State_Transfer#Public_implementations
Raise
Thanks, so with that line the rest of the code below in the action will be executed only if user clicked "submit". So is it a way to avoid a malicious user executes the action directly ? or what is the target?