From d858053a7c70b3fee0fe407420ff8bd1466d5de2 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Sat, 5 Apr 2025 23:15:37 +0200 Subject: Use HTTP POST for logout (#7489) * Use HTTP POST for logout To avoid potential CSRF risks * Fixed button font issue * Minor whitespace --- app/Controllers/authController.php | 10 +++++--- app/layout/aside_configure.phtml | 8 +++--- app/layout/header.phtml | 7 ++++- app/layout/simple.phtml | 10 +++++--- p/themes/Ansum/_sidebar.scss | 6 +++-- p/themes/Ansum/ansum.css | 32 +++++++++++++---------- p/themes/Ansum/ansum.css.map | 2 +- p/themes/Ansum/ansum.rtl.css | 30 ++++++++++++---------- p/themes/Flat/flat.css | 3 ++- p/themes/Flat/flat.rtl.css | 3 ++- p/themes/Mapco/_sidebar.scss | 4 +-- p/themes/Mapco/mapco.css | 30 ++++++++++++---------- p/themes/Mapco/mapco.css.map | 2 +- p/themes/Mapco/mapco.rtl.css | 28 ++++++++++---------- p/themes/Nord/nord.css | 3 ++- p/themes/Nord/nord.rtl.css | 3 ++- p/themes/Origine/origine.css | 1 + p/themes/Origine/origine.rtl.css | 1 + p/themes/Pafat/pafat.css | 3 ++- p/themes/Pafat/pafat.rtl.css | 3 ++- p/themes/Swage/swage.css | 52 ++++++++++++++++++++------------------ p/themes/Swage/swage.css.map | 2 +- p/themes/Swage/swage.rtl.css | 50 ++++++++++++++++++------------------ p/themes/Swage/swage.scss | 6 +++-- p/themes/base-theme/base.css | 3 ++- p/themes/base-theme/base.rtl.css | 3 ++- p/themes/base-theme/frss.css | 3 +++ p/themes/base-theme/frss.rtl.css | 3 +++ 28 files changed, 179 insertions(+), 132 deletions(-) diff --git a/app/Controllers/authController.php b/app/Controllers/authController.php index 9bad837f9..4de8d01f1 100644 --- a/app/Controllers/authController.php +++ b/app/Controllers/authController.php @@ -223,9 +223,13 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController { * This action removes all accesses of the current user. */ public function logoutAction(): void { - invalidateHttpCache(); - FreshRSS_Auth::removeAccess(); - Minz_Request::good(_t('feedback.auth.logout.success'), [ 'c' => 'index', 'a' => 'index' ]); + if (Minz_Request::isPost()) { + invalidateHttpCache(); + FreshRSS_Auth::removeAccess(); + Minz_Request::good(_t('feedback.auth.logout.success'), [ 'c' => 'index', 'a' => 'index' ]); + } else { + Minz_Error::error(403); + } } /** diff --git a/app/layout/aside_configure.phtml b/app/layout/aside_configure.phtml index d107e7f63..9824e7fa8 100644 --- a/app/layout/aside_configure.phtml +++ b/app/layout/aside_configure.phtml @@ -2,6 +2,9 @@ declare(strict_types=1); ?>