rgw: reject invalid methods in validate_cors_rule_method

Fixes: http://tracker.ceph.com/issues/24223
Signed-off-by: Jeegn Chen <jeegnchen@tencent.com>
(cherry picked from commit 8e34c65e3f59adb0ed549ad7ea394872c6e4248f)

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 98a6db4703f2caa1471757c95ff06ec00a5dc096..a0f96b0c5956607f4c04faec6e98795193b782e9 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -916,7 +916,7 @@ static bool validate_cors_rule_method(RGWCORSRule *rule, const char *req_meth) {
   else if (strcmp(req_meth, "DELETE") == 0) flags = RGW_CORS_DELETE;
   else if (strcmp(req_meth, "HEAD") == 0) flags = RGW_CORS_HEAD;
 
-  if ((rule->get_allowed_methods() & flags) == flags) {
+  if (rule->get_allowed_methods() & flags) {
     dout(10) << "Method " << req_meth << " is supported" << dendl;
   } else {
     dout(5) << "Method " << req_meth << " is not supported" << dendl;