From 6f5656ab0ebec03fe63898208dabc802c4be46ab Mon Sep 17 00:00:00 2001
From: John Olheiser <john.olheiser@gmail.com>
Date: Mon, 2 Mar 2020 23:54:15 -0600
Subject: [PATCH] Logout POST action (#10582) (#10585)

* Change logout to POST

* Update for redirect

* Revert octicon to font

Signed-off-by: jolheiser <john.olheiser@gmail.com>
---
 integrations/signout_test.go    | 2 +-
 routers/routes/routes.go        | 2 +-
 templates/base/head_navbar.tmpl | 2 +-
 web_src/js/index.js             | 3 +++
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/integrations/signout_test.go b/integrations/signout_test.go
index 65957b244..c31c91307 100644
--- a/integrations/signout_test.go
+++ b/integrations/signout_test.go
@@ -14,7 +14,7 @@ func TestSignOut(t *testing.T) {
 
 	session := loginUser(t, "user2")
 
-	req := NewRequest(t, "GET", "/user/logout")
+	req := NewRequest(t, "POST", "/user/logout")
 	session.MakeRequest(t, req, http.StatusFound)
 
 	// try to view a private repo, should fail
diff --git a/routers/routes/routes.go b/routers/routes/routes.go
index 424c3f65f..3202c62d6 100644
--- a/routers/routes/routes.go
+++ b/routers/routes/routes.go
@@ -399,7 +399,7 @@ func RegisterRoutes(m *macaron.Macaron) {
 		m.Post("/recover_account", user.ResetPasswdPost)
 		m.Get("/forgot_password", user.ForgotPasswd)
 		m.Post("/forgot_password", user.ForgotPasswdPost)
-		m.Get("/logout", user.SignOut)
+		m.Post("/logout", user.SignOut)
 	})
 	// ***** END: User *****
 
diff --git a/templates/base/head_navbar.tmpl b/templates/base/head_navbar.tmpl
index a09b4b832..9e76853d4 100644
--- a/templates/base/head_navbar.tmpl
+++ b/templates/base/head_navbar.tmpl
@@ -109,7 +109,7 @@
 					{{end}}
 
 					<div class="divider"></div>
-					<a class="item" href="{{AppSubUrl}}/user/logout">
+					<a class="item link-action" href data-url="{{AppSubUrl}}/user/logout" data-redirect="{{AppSubUrl}}/">
 						<i class="octicon octicon-sign-out"></i>
 						{{.i18n.Tr "sign_out"}}<!-- Sign Out -->
 					</a>
diff --git a/web_src/js/index.js b/web_src/js/index.js
index 062a3f7ef..eeb6bbd8c 100644
--- a/web_src/js/index.js
+++ b/web_src/js/index.js
@@ -2740,11 +2740,14 @@ function showAddAllPopup() {
 
 function linkAction() {
   const $this = $(this);
+  const redirect = $this.data('redirect');
   $.post($this.data('url'), {
     _csrf: csrf
   }).done((data) => {
     if (data.redirect) {
       window.location.href = data.redirect;
+    } else if (redirect) {
+      window.location.href = redirect;
     } else {
       window.location.reload();
     }