rgw: reject invalid methods in validate_cors_rule_method

Fixes: http://tracker.ceph.com/issues/24223
Signed-off-by: Jeegn Chen <jeegnchen@tencent.com>
(cherry picked from commit 8e34c65e3f59adb0ed549ad7ea394872c6e4248f)

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 4f4be1579efea49adb221dfab49e6a4a4b0733a4..a212c65f6eb413edff311b2e63c497fe6e4e4a3c 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -984,7 +984,7 @@ static bool validate_cors_rule_method(RGWCORSRule *rule, const char *req_meth) {
   else if (strcmp(req_meth, "DELETE") == 0) flags = RGW_CORS_DELETE;
   else if (strcmp(req_meth, "HEAD") == 0) flags = RGW_CORS_HEAD;
 
-  if ((rule->get_allowed_methods() & flags) == flags) {
+  if (rule->get_allowed_methods() & flags) {
     dout(10) << "Method " << req_meth << " is supported" << dendl;
   } else {
     dout(5) << "Method " << req_meth << " is not supported" << dendl;