haskell/hackage-server — pull request #200 by hesselink (2014-02-28 07:36:58+00:00)
Title: Fix deleting maintainers, and possibly other actions using _method.

The authentication hash for digest authentication includes the method, but that might have been changed by methodOverrideHack. rqRealMethod tries to find out if this was the case, and if so, returns POST instead of rqMethod. But it does this by looking at the post data, and Happstack doesn't return post data for requests other than POST and PUT.

For maintainers deletion, _method was set to DELETE, so authentication failed and users were repeatedly presented with authentication dialogs. We now set the method to POST temporarily before checking if a _method parameter was present.

Fixes #197.