Remove default match without specified method

In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.

In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.

This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.

Closes #5964

1 files changed, 2 insertions, 2 deletions

diff --git a/actionpack/test/controller/resources_test.rb b/actionpack/test/controller/resources_test.rb
index 3c0a5d36ca..9fc875014c 100644
--- a/actionpack/test/controller/resources_test.rb
+++ b/actionpack/test/controller/resources_test.rb
@@ -680,7 +680,7 @@ class ResourcesTest < ActionController::TestCase
         scope '/threads/:thread_id' do
           resources :messages, :as => 'thread_messages' do
             get :search, :on => :collection
-            match :preview, :on => :new
+            get :preview, :on => :new
           end
         end
       end
@@ -698,7 +698,7 @@ class ResourcesTest < ActionController::TestCase
         scope '/admin' do
           resource :account, :as => :admin_account do
             get :login, :on => :member
-            match :preview, :on => :new
+            get :preview, :on => :new
           end
         end
       end