Remove default match without specified method

In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.

In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.

This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.

Closes #5964

1 files changed, 2 insertions, 2 deletions

diff --git a/actionpack/test/dispatch/request_id_test.rb b/actionpack/test/dispatch/request_id_test.rb
index 4b98cd32f2..a8050b4fab 100644
--- a/actionpack/test/dispatch/request_id_test.rb
+++ b/actionpack/test/dispatch/request_id_test.rb
@@ -52,7 +52,7 @@ class RequestIdResponseTest < ActionDispatch::IntegrationTest
   def with_test_route_set
     with_routing do |set|
       set.draw do
-        match '/', :to => ::RequestIdResponseTest::TestController.action(:index)
+        get '/', :to => ::RequestIdResponseTest::TestController.action(:index)
       end
 
       @app = self.class.build_app(set) do |middleware|
@@ -62,4 +62,4 @@ class RequestIdResponseTest < ActionDispatch::IntegrationTest
       yield
     end
   end
-end
\ No newline at end of file
+end