Merge pull request pallets#816 from untitaker/allowed_methods

Fix pallets#815

Author: mitsuhiko

flask/app.py

@@ -949,6 +949,9 @@ def index():
         # a tuple of only `GET` as default.
         if methods is None:
             methods = getattr(view_func, 'methods', None) or ('GET',)
+        if isinstance(methods, string_types):
+            raise TypeError('Allowed methods have to be iterables of strings, '
+                            'for example: @app.route(..., methods=["POST"])')
         methods = set(methods)
 
         # Methods that should always be added

flask/testsuite/basic.py

@@ -85,6 +85,13 @@ def more():
         self.assert_equal(rv.status_code, 405)
         self.assert_equal(sorted(rv.allow), ['GET', 'HEAD', 'OPTIONS', 'POST'])
 
+    def test_disallow_string_for_allowed_methods(self):
+        app = flask.Flask(__name__)
+        with self.assert_raises(TypeError):
+            @app.route('/', methods='GET POST')
+            def index():
+                return "Hey"
+
     def test_url_mapping(self):
         app = flask.Flask(__name__)
         def index():