symfony - whats the point of using the @Method annotation -
Route method: A shortcut to specify the permitted HTTP method for the path is the @ method annotation. To use it, import the method annotation namespace:
Sensio \ Bundle \ FrameworkExtraBundle \ Configuration \ Route; Use Sensio \ Bundle \ FrameworkExtraBundle \ Configuration \ Method; / ** * Root ("/ blog") * / Class PostController Implementing the Administrator {@ ** (@ / "{ID}") * @ method ({"GET", "POST" }} / Public Function Edit Action ($ ID) {}}
I have seen many developers that the method is limited to limiting or posting, but since the controller By default both allow, why do developers want to restrict it to only one method? Is this some safety measure? And if so, what type of attack will protect you?
First of all, there are many ways available, not only received and posted
I do not think this is a security reason, it is a matter of respecting standards (for example). I personally use different methods for many behaviors. For me, see the version, and apply the version.
There are two different behaviors for a single URL even if the reaction results can not change at the end, the behavior at the controller level is different.I think this is a matter of choice of person, I like to watch
/ ** * @ Root ("/ edit") * @ method ( {"GET"}) * @template * / Public function editing action () {$ obj = new Foo; $ Obj- & gt; SetBaz ($ this- & gt; container- & gt; getParameter ('default_baz')); $ Type = new FooType; $ Form = $ this- & gt; Createform ($ type, $ obj, array ('action' => $ this-> generationalUrl ('acme_foo_bar_doedit'), 'method' = & gt; 'PUT')); Returns array ('form' = & gt; $ form-> createView ()); }
It is very clear what it does. It only instances the form you need, no user input is processed.
Now, you can add your action to process the version by adding another method(@ / "*" @ route ("/ edit") * @ method ({"PUT" }) @ Template ("AcmeFooBundle: bar: edit.html.twig") * / Public Function doEditAction (Request $ request) {$ obj = new Foo; $ Type = new FooType; $ form = $ this- & gt; Createform ($ type, $ obj, array ('action' => $ this-> generationalUrl ('acme_foo_bar_doedit'), 'method' = & gt; 'PUT')); $ Form & gt; handleRequest ($ request); If ($ form-> isValid ()) {// $ obj} play with return array ('form' = & gt; $ form-> createView ()); } It's easy, and can be easily accessed anywhere in your app (instead of the default version page)
Comments
Post a Comment