Canonical redirect is applied upon POST request

[c.axelsson]

If $_POST is empty a canonical redirect is still made even though it should be ignored upon all POST requests. As this redirect occurs before user have a chance to handle the request themselves in a template_redirect filter it prevents users to write proper REST APIs that include POST requests with no data.

A patch that uses $_SERVER['REQUEST_METHOD'] instead of relying on the $_POST variable to identify request type is attached.

[SergeyBiryukov]

Introduced in [5978], modified in [16797].

[c.axelsson]

I have attached an updated the patch that makes sure that the request actually is a GET request. It's needed for HTTP OPTIONS, DELETE, PATCH etc.

[SergeyBiryukov]

In 28958:

Canonical redirects should only be applied for GET requests.

props c.axelsson.
fixes #27498.

[nacin]

I don't see why HEAD requests should be ignored.

[markjaquith]

Agree with Nacin. HEAD requests really should have canonical redirects. I think this is a regression otherwise.

[SergeyBiryukov]

27498.patch​ adds HEAD requests to the condition.

[markjaquith]

We should probably strtoupper() first. PHP does not guarantee the value to be uppercase. The HTTP specs do, but you never know what a requester will do.

[SergeyBiryukov]

Indeed, see 27498.2.patch​.

[nacin]

template-loader.php is way simpler:

if ( 'HEAD' === $_SERVER['REQUEST_METHOD'] && apply_filters( 'exit_on_http_head', true ) )
	exit();

This also happens to fail when it isn't set, but you're usually not running template-loader.php via CLI.

I'm fine with adjusting template-loader.php later, just pointing out where else we do this.

[nacin]

In 29663:

Canonical: Apply redirects to HEAD requests too. Adjusts [28958].

props SergeyBiryukov.
fixes #27498.