Use POST instead of GET for logging out (#13022).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@11289 e93f8b46-1217-0410-a6f0-8f06a7374b81
2013-01-30 17:34:48 +00:00
parent 41faf7f5f5
commit f2fd78f7b8
6 changed files with 35 additions and 9 deletions
@@ -38,8 +38,13 @@ class AccountController < ApplicationController

  # Log out current user and redirect to welcome page
  def logout
-    logout_user
-    redirect_to home_url
+    if User.current.anonymous?
+      redirect_to home_url
+    elsif request.post?
+      logout_user
+      redirect_to home_url
+    end
+    # display the logout form
  end

  # Lets user choose a new password