Leantime/leantime · warning · Error

This endpoint only supports PATCH requests

Error message

This endpoint only supports PATCH requests

What it means

The guard in Checklist::updateSubtask() intends to reject non-PATCH requests, but the condition is written as `! $this->incomingRequest->getMethod() == 'PATCH'`. PHP parses this as `(!getMethod()) == 'PATCH'`: negating a non-empty string yields false, and false == 'PATCH' is false, so the if-branch never executes and the \Error is unreachable dead code. In practice /hx/projects/checklist/updateSubtask currently accepts every HTTP verb — the advertised restriction does not exist.

Source

Thrown at app/Domain/Projects/Hxcontrollers/Checklist.php:34

    /**
     * Controller constructor
     *
     * @param  Projects  $projectService  The projects domain service.
     */
    public function init(Projects $projectService): void
    {
        $this->projectService = $projectService;
    }

    /**
     * Updates subtask status
     *
     * @throws BindingResolutionException
     */
    public function updateSubtask(): void
    {
        if (! $this->incomingRequest->getMethod() == 'PATCH') {
            throw new Error('This endpoint only supports PATCH requests');
        }

        // update project progress
        $projectProgress = $this->incomingRequest->request->all();

        $this->projectService->updateProjectProgress($projectProgress, session('currentProject'));

        // return view with new data
        [$progressSteps, $percentDone] = $this->projectService->getProjectSetupChecklist(session('currentProject'));
        $this->tpl->assign('progressSteps', $progressSteps);
        $this->tpl->assign('percentDone', $percentDone);
        $this->tpl->assign('includeTitle', false);
    }
}

View on GitHub (pinned to 9a9f49f100)

Solutions

1. Fix the comparison to $this->incomingRequest->getMethod() !== 'PATCH' so the guard actually runs
2. Prefer enforcing the verb at the route/routing layer and deleting the broken inline guard
3. If this endpoint is exposed to untrusted callers, treat the missing method restriction as a real defect and patch it before shipping

Example fix

// before
if (! $this->incomingRequest->getMethod() == 'PATCH') {
    throw new Error('This endpoint only supports PATCH requests');
}

// after
if ($this->incomingRequest->getMethod() !== 'PATCH') {
    throw new Error('This endpoint only supports PATCH requests');
}

// client side (htmx does this for you with hx-patch)
if (fetchParams.method !== 'PATCH') {
    throw new Error('updateSubtask requires PATCH');
}

When it happens

Trigger: None as written — the error can never fire. It would only trigger for GET/POST/etc. requests if the operator were corrected to !==. Meanwhile any verb reaching the endpoint proceeds to updateProjectProgress().

Common situations: Developers reading the message and assuming verb enforcement exists (e.g., when auditing an HTMX endpoint); relying on this guard as a security control; adding hx-post/hx-get callers that unexpectedly succeed against a 'PATCH-only' endpoint.

Related errors

• Plugin %s is not installed

AI-assisted analysis of Leantime/leantime@9a9f49f100 (2026-08-21). Data as JSON: /api/errors/07ad1a9926a3328b. Report an issue: GitHub.