client/server: login is using POST, so use POST, not XMLHttpRequest

TODO: Logout requires styling plus only to appear if logged in.

2 files changed, 5 insertions, 6 deletions

diff --git a/src/client/buttons.js b/src/client/buttons.js
index e29a1729..5fd8d121 100644
--- a/src/client/buttons.js
+++ b/src/client/buttons.js
@@ -67,11 +67,6 @@ $('.local-storage-load a').click(function(){
   rz_core.load_from_json(json_blob);
 });
 
-var logout_button = $('#logout-button');
-logout_button.click(function() {
-    $.ajax({ type: "POST", url: '/logout'}); // server should redirect back to /login
-});
-
 $('a.save-history').click(function() {
     if (rz_core.main_graph.history === undefined) {
         throw "History is undefined";
diff --git a/src/server/rz_api.py b/src/server/rz_api.py
index 3b6d9585..fc2e2343 100644
--- a/src/server/rz_api.py
+++ b/src/server/rz_api.py
@@ -170,7 +170,7 @@ def index():
 def login():
 
     def sanitize_input(req):
-        req_json = request.get_json()
+        req_json = request.form.to_dict()
         u = req_json['username']
         p = req_json['password']
         return u, p
@@ -178,6 +178,10 @@ def login():
     if request.method == 'POST':
         try:
             u, p = sanitize_input(request)
+        except:
+            log.warn('failed to sanitize inputs. request: %s' % request)
+            return render_template('login.html', login_failed=True)
+        try:
             crypt_util.validate_login(flask.current_app.rz_config, u, p)
         except Exception as e:
             # login failed