(bug 44921) API should properly handle OPTIONS

When given an OPTIONS request, ApiMain should return just after the CORS
check. It should not actually execute the action or return any response
body.

Change-Id: I1c16cb89e777aaac69ae86b532d16f4c10a1f1d2

diff --git a/RELEASE-NOTES-1.21 b/RELEASE-NOTES-1.21
index 51259de..bd72d8b 100644 (file)
--- a/RELEASE-NOTES-1.21
+++ b/RELEASE-NOTES-1.21
@@ -233,6 +233,8 @@ production.
   particular page property.
 * Added an API query module list=pagepropnames, which lists all page prop names
   currently in use on the wiki.
+* (bug 44921) ApiMain::execute() will now return after the CORS check for an
+  HTTP OPTIONS request.
 
 === API internal changes in 1.21 ===
 * For debugging only, a new global $wgDebugAPI removes many API restrictions when true.

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index c3ae8b1..1dabbbf 100644 (file)
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -364,6 +364,12 @@ class ApiMain extends ApiBase {
                        return;
                }
 
+               // Exit here if the request method was OPTIONS
+               // (assume there will be a followup GET or POST)
+               if ( $this->getRequest()->getMethod() === 'OPTIONS' ) {
+                       return;
+               }
+
                // In case an error occurs during data output,
                // clear the output buffer and print just the error information
                ob_start();