From 1d683d1d8f38928949a282b51847259aa0a20948 Mon Sep 17 00:00:00 2001 From: Jan Date: Wed, 8 Apr 2026 10:29:53 +0200 Subject: [PATCH] control: fix body rejection guard for empty POST requests rejectBody() returns true when the request body is acceptable and false when a body must be rejected. The TX and fault-reset handlers treated the return value the wrong way around and returned early on valid empty POST requests. This prevented actions like /tx/stop from running in the normal no-body case. Update the handlers to only abort when rejectBody() reports an actual rejection, so empty POST control actions proceed as intended. --- internal/control/control.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/internal/control/control.go b/internal/control/control.go index 0af6741..e4cf0f5 100644 --- a/internal/control/control.go +++ b/internal/control/control.go @@ -155,12 +155,15 @@ func hasRequestBody(r *http.Request) bool { } func (s *Server) rejectBody(w http.ResponseWriter, r *http.Request) bool { + // Returns true when the request has an unexpected body and the error response + // has already been written — callers should return immediately in that case. + // Returns false when there is no body (happy path — request should proceed). if !hasRequestBody(r) { - return true + return false } s.recordAudit(auditUnexpectedBody) http.Error(w, noBodyErrMsg, http.StatusBadRequest) - return false + return true } func (s *Server) recordAudit(evt auditEvent) {