Commit aed045b1 authored by jplang's avatar jplang

Use POST instead of GET for logging out (#13022).

git-svn-id: https://svn.redmine.org/redmine/trunk@11289 e93f8b46-1217-0410-a6f0-8f06a7374b81
parent b5cf3af1
......@@ -38,8 +38,13 @@ class AccountController < ApplicationController
# Log out current user and redirect to welcome page
def logout
logout_user
redirect_to home_url
if User.current.anonymous?
redirect_to home_url
elsif request.post?
logout_user
redirect_to home_url
end
# display the logout form
end
# Lets user choose a new password
......
<%= form_tag(signout_path) do %>
<p><%= submit_tag l(:label_logout) %></p>
<% end %>
......@@ -208,7 +208,7 @@ Redmine::MenuManager.map :account_menu do |menu|
menu.push :login, :signin_path, :if => Proc.new { !User.current.logged? }
menu.push :register, :register_path, :if => Proc.new { !User.current.logged? && Setting.self_registration? }
menu.push :my_account, { :controller => 'my', :action => 'account' }, :if => Proc.new { User.current.logged? }
menu.push :logout, :signout_path, :if => Proc.new { User.current.logged? }
menu.push :logout, :signout_path, :html => {:method => 'post'}, :if => Proc.new { User.current.logged? }
end
Redmine::MenuManager.map :application_menu do |menu|
......
......@@ -80,9 +80,18 @@ class AccountControllerTest < ActionController::TestCase
assert_response 302
end
def test_logout
def test_get_logout_should_not_logout
@request.session[:user_id] = 2
get :logout
assert_response :success
assert_template 'logout'
assert_equal 2, @request.session[:user_id]
end
def test_logout
@request.session[:user_id] = 2
post :logout
assert_redirected_to '/'
assert_nil @request.session[:user_id]
end
......@@ -91,7 +100,7 @@ class AccountControllerTest < ActionController::TestCase
@controller.expects(:reset_session).once
@request.session[:user_id] = 2
get :logout
post :logout
assert_response 302
end
......
......@@ -85,6 +85,13 @@ class WelcomeControllerTest < ActionController::TestCase
:content => %r{warnLeavingUnsaved}
end
def test_logout_link_should_post
@request.session[:user_id] = 2
get :index
assert_select 'a[href=/logout][data-method=post]', :text => 'Sign out'
end
def test_call_hook_mixed_in
assert @controller.respond_to?(:call_hook)
end
......
......@@ -25,10 +25,12 @@ class RoutingAccountTest < ActionController::IntegrationTest
{ :controller => 'account', :action => 'login' }
)
end
assert_routing(
{ :method => 'get', :path => "/logout" },
{ :controller => 'account', :action => 'logout' }
)
["get", "post"].each do |method|
assert_routing(
{ :method => method, :path => "/logout" },
{ :controller => 'account', :action => 'logout' }
)
end
["get", "post"].each do |method|
assert_routing(
{ :method => method, :path => "/account/register" },
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment