mdipierro/web2py — pull request #27 by gcw (2012-05-30 06:55:33+00:00)
Title: ReST engine fix for field.readable=False

Problem:
If someone uses the rest decorator on a controller action and calls parse_as_rest() without 'auto' to generate the patterns their fields .readable value will be ignored allowing anyone accessing the ReST service to call arbitrary fields.

This is a fix that returns 404 Permission denied.

while I was at it I fixed a few typos... just a few