Remove default match without specified method

In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.

In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.

This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.

Closes #5964

1 files changed, 7 insertions, 7 deletions

diff --git a/actionpack/test/controller/base_test.rb b/actionpack/test/controller/base_test.rb
index 2032aca52e..b9513ccff4 100644
--- a/actionpack/test/controller/base_test.rb
+++ b/actionpack/test/controller/base_test.rb
@@ -158,7 +158,7 @@ class UrlOptionsTest < ActionController::TestCase
   def test_url_for_query_params_included
     rs = ActionDispatch::Routing::RouteSet.new
     rs.draw do
-      match 'home' => 'pages#home'
+      get 'home' => 'pages#home'
     end
 
     options = {
@@ -174,8 +174,8 @@ class UrlOptionsTest < ActionController::TestCase
   def test_url_options_override
     with_routing do |set|
       set.draw do
-        match 'from_view', :to => 'url_options#from_view', :as => :from_view
-        match ':controller/:action'
+        get 'from_view', :to => 'url_options#from_view', :as => :from_view
+        get ':controller/:action'
       end
 
       get :from_view, :route => "from_view_url"
@@ -189,7 +189,7 @@ class UrlOptionsTest < ActionController::TestCase
   def test_url_helpers_does_not_become_actions
     with_routing do |set|
       set.draw do
-        match "account/overview"
+        get "account/overview"
       end
 
       assert !@controller.class.action_methods.include?("account_overview_path")
@@ -208,8 +208,8 @@ class DefaultUrlOptionsTest < ActionController::TestCase
   def test_default_url_options_override
     with_routing do |set|
       set.draw do
-        match 'from_view', :to => 'default_url_options#from_view', :as => :from_view
-        match ':controller/:action'
+        get 'from_view', :to => 'default_url_options#from_view', :as => :from_view
+        get ':controller/:action'
       end
 
       get :from_view, :route => "from_view_url"
@@ -226,7 +226,7 @@ class DefaultUrlOptionsTest < ActionController::TestCase
         scope("/:locale") do
           resources :descriptions
         end
-        match ':controller/:action'
+        get ':controller/:action'
       end
 
       get :from_view, :route => "description_path(1)"