From abc4a47c1cb4cbd9de69c09c975a991e9957e387 Mon Sep 17 00:00:00 2001
From: aler9 <46489434+aler9@users.noreply.github.com>
Date: Fri, 30 Jul 2021 21:35:13 +0200
Subject: [PATCH] hls: reject methods other than GET and OPTIONS

---
 internal/core/hls_server.go | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/internal/core/hls_server.go b/internal/core/hls_server.go
index 872fa9e0..03d09e24 100644
--- a/internal/core/hls_server.go
+++ b/internal/core/hls_server.go
@@ -146,14 +146,22 @@ func (s *hlsServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Add("Access-Control-Allow-Origin", s.hlsAllowOrigin)
 	w.Header().Add("Access-Control-Allow-Credentials", "true")
 
-	if r.Method == http.MethodOptions {
+	switch r.Method {
+	case http.MethodGet:
+
+	case http.MethodOptions:
 		w.Header().Add("Access-Control-Allow-Methods", "GET, OPTIONS")
 		w.Header().Add("Access-Control-Allow-Headers", r.Header.Get("Access-Control-Request-Headers"))
 		w.WriteHeader(http.StatusOK)
 		return
+
+	default:
+		w.WriteHeader(http.StatusNotFound)
+		return
 	}
 
-	if pa == "" || pa == "favicon.ico" {
+	switch pa {
+	case "", "favicon.ico":
 		w.WriteHeader(http.StatusNotFound)
 		return
 	}