login+logout: using ajax, not POST, plus document.window (worst of both worlds)

2 files changed, 17 insertions, 2 deletions

diff --git a/src/client/buttons.js b/src/client/buttons.js
index 5fd8d121..dfd2c5f3 100644
--- a/src/client/buttons.js
+++ b/src/client/buttons.js
@@ -67,6 +67,21 @@ $('.local-storage-load a').click(function(){
   rz_core.load_from_json(json_blob);
 });
 
+var logout_button = $('#logout-button');
+logout_button.click(function() {
+    $.ajax({
+        type: "POST",
+        url: '/logout',
+        success: function () {
+            document.location = "/login";
+        },
+        error: function () {
+            console.log("failed to logout");
+            document.location = "/login";
+        },
+    }); // server should redirect back to /login
+});
+
 $('a.save-history').click(function() {
     if (rz_core.main_graph.history === undefined) {
         throw "History is undefined";
diff --git a/src/server/rz_api.py b/src/server/rz_api.py
index fc2e2343..2a2500bb 100644
--- a/src/server/rz_api.py
+++ b/src/server/rz_api.py
@@ -170,7 +170,7 @@ def index():
 def login():
 
     def sanitize_input(req):
-        req_json = request.form.to_dict()
+        req_json = request.get_json()
         u = req_json['username']
         p = req_json['password']
         return u, p
@@ -191,7 +191,7 @@ def login():
         # login successful
         session['username'] = u
         log.debug('login: success: user: %s' % (u))
-        return redirect('/index')
+        return '{}';
 
     if request.method == 'GET':
         return render_template('login.html')