Merged r3309 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/0.8-stable@3319 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/account_controller.rb

@@ -188,12 +188,12 @@ class AccountController < ApplicationController
   
 private
   def logged_user=(user)
+    reset_session
     if user && user.is_a?(User)
       User.current = user
       session[:user_id] = user.id
     else
       User.current = User.anonymous
-      session[:user_id] = nil
     end
   end
 end

app/views/issues/_form.rhtml

@@ -28,7 +28,7 @@
 <p><%= f.select :category_id, (@project.issue_categories.collect {|c| [c.name, c.id]}), :include_blank => true %>
 <%= prompt_to_remote(l(:label_issue_category_new),
                      l(:label_issue_category_new), 'category[name]', 
-                     {:controller => 'projects', :action => 'add_issue_category', :id => @project},
+                     {:controller => 'projects', :action => 'add_issue_category', :id => @project, :authenticity_token => form_authenticity_token},
                      :class => 'small', :tabindex => 199) if authorize_for('projects', 'add_issue_category') %></p>
 <% end %>
 <%= content_tag('p', f.select(:fixed_version_id, 

app/views/repositories/_dir_list_content.rhtml

@@ -1,7 +1,7 @@
 <% @entries.each do |entry| %>
 <% tr_id = Digest::MD5.hexdigest(entry.path)
    depth = params[:depth].to_i %>
-<tr id="<%= tr_id %>" class="<%= params[:parent_id] %> entry <%= entry.kind %>">
+<tr id="<%= tr_id %>" class="<%= h params[:parent_id] %> entry <%= entry.kind %>">
 <td style="padding-left: <%=18 * depth%>px;" class="filename">
 <% if entry.is_dir? %>
 <span class="expander" onclick="<%=  remote_function :url => {:action => 'browse', :id => @project, :path => to_path_param(entry.path), :rev => @rev, :depth => (depth + 1), :parent_id => tr_id},

public/javascripts/application.js

@@ -69,7 +69,8 @@ function setPredecessorFieldsVisibility() {
 function promptToRemote(text, param, url) {
     value = prompt(text + ':');
     if (value) {
-        new Ajax.Request(url + '?' + param + '=' + encodeURIComponent(value), {asynchronous:true, evalScripts:true});
+    		var sep = (url.indexOf('?') < 0 ? '?' : '&' )
+        new Ajax.Request(url + sep + param + '=' + encodeURIComponent(value), {asynchronous:true, evalScripts:true});
         return false;
     }
 }

test/integration/account_test.rb

@@ -147,6 +147,24 @@ class AccountTest < ActionController::IntegrationTest
     assert user.hashed_password.blank?
   end
   
+  def test_login_and_logout_should_clear_session
+    get '/login'
+    sid = session.session_id
+    
+    post '/login', :username => 'admin', :password => 'admin'
+    assert_redirected_to 'my/page'
+    assert_not_equal sid, session.session_id, "login should reset session"
+    assert_equal 1, session[:user_id]
+    sid = session.session_id
+    
+    get '/'
+    assert_equal sid, session.session_id
+      
+    get '/logout'
+    assert_not_equal sid, session.session_id, "logout should reset session"
+    assert_nil session[:user_id]
+  end
+  
   else
     puts 'Mocha is missing. Skipping tests.'
   end