When an action contained an attribute derived from HttpMethodAttribute,
doesn't specify an attribute route and there is also another attribute
extending HttpMethodAttribute that has a route defined on it; we ignored
the HttpMethodAttribute attribute without a defined route when building
the set of action selectors for the method.
This caused the resulting action to be unbounded and to accept requests
for other verbs not associated with it. The root cause of the problem was
that attributes override equality and do a field by field comparison but
ignore fields in the base classes of the type, so if an attribute is part
of a class hierarchy (like Http*Attributes) there might be two different
attributes that get considered equal.
The fix for the problem has been to change using Contains on a couple of
collections (that uses the equals method on the underlying object) and
check for the existence of the attribute on the collection directly by
using reference equality.
Pranav K
bchavez
Kiran Challa
jacalvar
Ryan Nowak
Caleb Nelton
N. Taylor Mullen