Commit bf4ccb0e authored by Birte Kristina Friesel's avatar Birte Kristina Friesel
Browse files

Logout: Use a POST form as it's a stateful action

parent fd608391

index.pl

+4 −0
Original line number Diff line number Diff line
@@ -1176,6 +1176,10 @@ get '/export.json' => sub { 


post '/logout' => sub {

	my ($self) = @_;

	if ( $self->validation->csrf_protect->has_error('csrf_token') ) {

		$self->render( 'login', invalid => 'csrf' );

		return;

	}

	$self->logout;

	$self->redirect_to('/login');

};

templates/login.html.ep

+7 −1
Original line number Diff line number Diff line
@@ -7,7 +7,13 @@ 
					<p>

						Du bist bereits angemeldet. Falls du mehrere Accounts hast

						und auf einen anderen wechseln möchtest, musst du dich

						vorher <a href="/logout">abmelden</a>.

						vorher

						%= form_for 'logout' => begin

							%= csrf_field

							<button class="btn waves-effect waves-light" type="submit" name="action" value="logout">

								Abmelden

							</button>

						%= end

					</p>

				</div>

			</div>