From d858053a7c70b3fee0fe407420ff8bd1466d5de2 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sat, 5 Apr 2025 23:15:37 +0200
Subject: Use HTTP POST for logout (#7489)

* Use HTTP POST for logout
To avoid potential CSRF risks

* Fixed button font issue

* Minor whitespace
---
 app/layout/header.phtml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'app/layout/header.phtml')

diff --git a/app/layout/header.phtml b/app/layout/header.phtml
index b152ed78a..1e4290f98 100644
--- a/app/layout/header.phtml
+++ b/app/layout/header.phtml
@@ -50,6 +50,9 @@
 
 	<?php if (FreshRSS_Auth::hasAccess()) { ?>
 	<nav class="item configure">
+		<form id="post-csrf" method="post">
+			<input type="hidden" name="_csrf" value="<?= FreshRSS_Auth::csrfToken() ?>" />
+		</form>
 		<div class="dropdown">
 			<div id="dropdown-configure" class="dropdown-target"></div>
 			<a class="btn dropdown-toggle" href="#dropdown-configure"><?= _i('configure') ?></a>
@@ -63,7 +66,9 @@
 					<ul>
 						<li class="item"><a href="<?= _url('user', 'profile') ?>"><?= _t('gen.menu.user_profile') ?></a></li>
 						<?php if (FreshRSS_Auth::accessNeedsAction()): ?>
-						<li class="item"><a class="signout" href="<?= _url('auth', 'logout') ?>"><?= _t('gen.auth.logout'); ?><?= _i('logout') ?></a></li>
+						<li class="item">
+							<button class="as-link signout" form="post-csrf" formaction="<?= _url('auth', 'logout') ?>"><?= _t('gen.auth.logout'); ?><?= _i('logout') ?></button>
+						</li>
 						<?php else: ?>
 						<li class="item"><span class="signout">(<?= htmlspecialchars(Minz_User::name() ?? '', ENT_NOQUOTES, 'UTF-8') ?>)</span></li>
 						<?php endif; ?>
-- 
cgit v1.2.3