The rc server decoded the whole POST body before looking up the method
and checking whether it needed authorisation, then echoed the decoded
input back in the 403 or 404 error. A client that was not allowed to
call a method could still make rclone read, decode and re-encode its
request.
The method lookup and authorisation check now happen before the body
is read, and these errors no longer echo the request input.
Nick Craig-Wood
53b2d7aaf2