Redmine

The "Add watcher" button in the sidebar of issues is a javascript-ified link. Sometimes, crawlers hit this raw link and request non-JS data.

This currently results in the rendering JS template. However, the response is eventually blocked by ActionController::RequestForgeryProtection#verify_same_origin_request which is run as an after_action. This method then throws an ActionController::InvalidCrossOriginRequest error and denies sending the rendered data to the client to avoid sending an unauthorized cross-origin response.

This exception is then later handled by the ActionDispatch::ExceptionWrapper middleware which in turn send an empty 406 response.

The attached patch fixes this behavior by explicitly sending a 404 response when the (default) html format was requested for the watchers#new action. This hopefully keeps strange crawlers from further crawling this link...