diff --git a/config/admin.php b/config/admin.php index d1fa939154..e86660e944 100644 --- a/config/admin.php +++ b/config/admin.php @@ -182,6 +182,11 @@ 'enable' => true, + /* + * Only logging allowed methods in the list + */ + 'allowed_methods' => ['GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'CONNECT', 'OPTIONS', 'TRACE', 'PATCH'], + /* * Routes that will not log to database. * diff --git a/src/Middleware/LogOperation.php b/src/Middleware/LogOperation.php index ac367a2071..ba52f29ea2 100644 --- a/src/Middleware/LogOperation.php +++ b/src/Middleware/LogOperation.php @@ -42,10 +42,29 @@ public function handle(Request $request, \Closure $next) protected function shouldLogOperation(Request $request) { return config('admin.operation_log.enable') - && !$this->inExceptArray($request) + && !$this->inExceptArray($request) && $this->inAllowedMethods($request->method()) && Admin::user(); } + + /** + * @param $method + * + * @return bool + */ + protected function inAllowedMethods($method) { + $allowed_methods = array_map('strtoupper', (array)config('admin.operation_log.allowed_methods')); + if (empty($allowed_methods)) { + return true; + } else { + if (in_array($method, $allowed_methods)) { + return true; + } else { + return false; + } + } + } + /** * Determine if the request has a URI that should pass through CSRF verification. *