Use POST instead of GET for logging out (#13022).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@11289 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/account_controller.rb

@@ -38,8 +38,13 @@ class AccountController < ApplicationController
 
   # Log out current user and redirect to welcome page
   def logout
-    logout_user
-    redirect_to home_url
+    if User.current.anonymous?
+      redirect_to home_url
+    elsif request.post?
+      logout_user
+      redirect_to home_url
+    end
+    # display the logout form
   end
 
   # Lets user choose a new password

app/views/account/logout.html.erb

@@ -0,0 +1,3 @@
+<%= form_tag(signout_path) do %>
+  <p><%= submit_tag l(:label_logout) %></p>
+<% end %>