BUG: Update viewAction to accept only valid verbs

See http://resources.infosecinstitute.com/http-verb-tempering-bypassing-web-authentication-and-authorization/

Co-authored-by: Matt McCormick <matt.mccormick@kitware.com>
Co-authored-by: Michael Grauer <michael.grauer@kitware.com>

Author: 3 people

core/controllers/FolderController.php

@@ -160,7 +160,9 @@ public function viewAction()
         $folder_id = $this->getParam('folderId');
         $folder = $this->Folder->load($folder_id);
 
-        if (!isset($folder_id)) {
+        if (!$this->_request->isGet()) {
+            throw new Zend_Exception('Only HTTP Get requests are accepted', 400);
+        } elseif (!isset($folder_id)) {
             throw new Zend_Exception('Please set the folderId.');
         } elseif ($folder === false) {
             throw new Zend_Exception("The folder doesn't exist.", 404);

core/controllers/ItemController.php

@@ -112,6 +112,10 @@ public function editmetadataAction()
      */
     public function viewAction()
     {
+        if (!($this->_request->isGet() || $this->_request->isPost())) {
+            throw new Zend_Exception('Only HTTP Get or Post requests are accepted', 400);
+        }
+
         $this->view->Date = $this->Component->Date;
         $itemId = $this->getParam('itemId');
 

core/controllers/UserController.php

@@ -699,6 +699,10 @@ public function userexistsAction()
     /** Settings page action */
     public function settingsAction()
     {
+        if (!($this->_request->isGet() || $this->_request->isPost())) {
+            throw new Zend_Exception('Only HTTP Get or Post requests are accepted', 400);
+        }
+
         if (!$this->logged) {
             $this->disableView();
 
@@ -1061,6 +1065,9 @@ public function settingsAction()
     /** User page action */
     public function userpageAction()
     {
+        if (!$this->_request->isGet()) {
+            throw new Zend_Exception('Only HTTP Get requests are accepted', 400);
+        }
         $this->view->Date = $this->Component->Date;
         $user_id = $this->getParam('user_id');