From 4c96da3d567107fc87acec3e80c13901b99b5958 Mon Sep 17 00:00:00 2001 From: Johannes Meyer Date: Tue, 2 Oct 2018 15:24:11 +0200 Subject: [PATCH] auth/external: Use a stripped down layout for the logout workaround We've used the standard layout before which caused a automatic login. Automatic because the browser saw our js/css tags and accessed the routes which in turn logged in the user, but only if there's a enabled module which's configuration.php (or run.php) accesses the Auth singleton. The stripped down layout provides its own js/css so there's no need for our full-blown resources. fixes #3583 --- .../controllers/AuthenticationController.php | 1 + .../layouts/scripts/external-logout.phtml | 33 ++++++++++++++++++ .../views/scripts/authentication/logout.phtml | 34 ++++++++++++++++++- 3 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 application/layouts/scripts/external-logout.phtml diff --git a/application/controllers/AuthenticationController.php b/application/controllers/AuthenticationController.php index 3e8843722..c6fedb57c 100644 --- a/application/controllers/AuthenticationController.php +++ b/application/controllers/AuthenticationController.php @@ -74,6 +74,7 @@ class AuthenticationController extends Controller AuthenticationHook::triggerLogout($auth->getUser()); $auth->removeAuthorization(); if ($isExternalUser) { + $this->view->layout()->setLayout('external-logout'); $this->getResponse()->setHttpResponseCode(401); } else { $this->redirectToLogin(); diff --git a/application/layouts/scripts/external-logout.phtml b/application/layouts/scripts/external-logout.phtml new file mode 100644 index 000000000..a1df8b7ba --- /dev/null +++ b/application/layouts/scripts/external-logout.phtml @@ -0,0 +1,33 @@ +language; +$showFullscreen = $this->layout()->showFullscreen; +$innerLayoutScript = $this->layout()->innerLayout . '.phtml'; + +?> + + + + + + + + + <?= $this->title ? $this->escape($this->title) : $this->defaultTitle ?> + + + + + + + + + +
+ render($innerLayoutScript); ?> +
+ + diff --git a/application/views/scripts/authentication/logout.phtml b/application/views/scripts/authentication/logout.phtml index f7ad84b8c..d4bd78e01 100644 --- a/application/views/scripts/authentication/logout.phtml +++ b/application/views/scripts/authentication/logout.phtml @@ -8,6 +8,7 @@ logged-in user this JavaScript provides a workaround to force a new authentication prompt in most browsers. -->
+
translate('Logging out...'); ?>
@@ -19,7 +20,7 @@
- translate('Login'); ?> + translate('Login'); ?>
+