From d858053a7c70b3fee0fe407420ff8bd1466d5de2 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sat, 5 Apr 2025 23:15:37 +0200
Subject: Use HTTP POST for logout (#7489)

* Use HTTP POST for logout
To avoid potential CSRF risks

* Fixed button font issue

* Minor whitespace
---
 app/layout/simple.phtml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'app/layout/simple.phtml')

diff --git a/app/layout/simple.phtml b/app/layout/simple.phtml
index a79d102af..2a14682c9 100644
--- a/app/layout/simple.phtml
+++ b/app/layout/simple.phtml
@@ -60,13 +60,15 @@
 
 		<div class="item"></div>
 
+		<form id="post-csrf" method="post">
+			<input type="hidden" name="_csrf" value="<?= FreshRSS_Auth::csrfToken() ?>" />
+		</form>
+
 		<?php if (FreshRSS_Auth::accessNeedsAction()): ?>
 			<div class="item configure">
 			<?php if (FreshRSS_Auth::hasAccess()): ?>
-				<a class="signout" href="<?= Minz_Url::display(['c' => 'auth', 'a' => 'logout'], 'html', 'root') ?>">
-					<?= _i('logout') ?><?= _t('gen.auth.logout') ?>
-					(<?= htmlspecialchars(Minz_User::name() ?? '', ENT_NOQUOTES, 'UTF-8') ?>)
-				</a>
+				<button class="as-link signout" form="post-csrf" formaction="<?=
+					_url('auth', 'logout') ?>"><?= _t('gen.auth.logout'); ?><?= _i('logout') ?></button>
 			<?php else: ?>
 				<a class="signin" href="<?= Minz_Url::display(['c' => 'auth', 'a' => 'login'], 'html', 'root') ?>">
 					<?= _i('login') ?><?= _t('gen.auth.login') ?>
-- 
cgit v1.2.3