Github user ChristopherSchultz commented on the issue:
https://github.com/apache/tomcat/pull/96
Patch looks good to me.
Regarding your questions:
> Why is a POST allowed when readOnly is true?
Probably because the DefaultServlet just delegates POST -> GET, but ...
> Why does a POST call GET internally?
Good question. I suspect because that's what httpd does when making a POST
request to a static resource.
That code has not changed since 2006 (the initial import) so at this point,
it's "legacy" and "backward-compatible" and extremely unlikely to change.
---
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
