GET method is allowed on verify-email endpoint

[axnsan12]

VerifyEmailView should override http_method_names instead of allowed_methods, in order to restrict the get method of its parent ConfirmationEmailView. As it stands, overriding default_methods has no effect and GET is wrongly allowed, calling ConfirmationEmailView.get() from allauth.

django-rest-auth/rest_auth/registration/views.py

Line 80 in 42d039b

allowed_methods = ('POST', 'OPTIONS', 'HEAD')

Background:

APIView from rest_framework defines allowed_methods as

    def allowed_methods(self):

        """
        Wrap Django's private `_allowed_methods` interface in a public property.
        """
        return self._allowed_methods()

which references django's _allowed_methods():

    def _allowed_methods(self):
        return [m.upper() for m in self.http_method_names if hasattr(self, m)]

However, APIView.dispatch() actually checks http_method_names:

    def dispatch(self, request, *args, **kwargs):
        """
        `.dispatch()` is pretty much the same as Django's regular dispatch,
        but with extra hooks for startup, finalize, and exception handling.
        """
        self.args = args
        self.kwargs = kwargs
        request = self.initialize_request(request, *args, **kwargs)
        self.request = request
        self.headers = self.default_response_headers  # deprecate?

        try:
            self.initial(request, *args, **kwargs)

            # Get the appropriate handler method
            if request.method.lower() in self.http_method_names:  # <----------- HERE
                handler = getattr(self, request.method.lower(),
                                  self.http_method_not_allowed)
            else:
                handler = self.http_method_not_allowed

            response = handler(request, *args, **kwargs)

        except Exception as exc:
            response = self.handle_exception(exc)

        self.response = self.finalize_response(request, response, *args, **kwargs)
        return self.response

Taken from Djang 1.11.6, django-rest-auth 0.9.2, djangorestframework 3.7.0