From 25419b3efd10d4d90c1c64c777aab31397c4f35d Mon Sep 17 00:00:00 2001
From: LV-426 <lv-426@taproot.org.il>
Date: Sun, 5 Apr 2015 17:25:40 +0300
Subject: rest__logout: redirect on GET, invalidate cookie on GET/POST

---
 src/server/rz_server.py |  7 ++-----
 src/server/rz_user.py   | 17 +++++++++++++----
 2 files changed, 15 insertions(+), 9 deletions(-)

(limited to 'src/server')

diff --git a/src/server/rz_server.py b/src/server/rz_server.py
index 62e3fc6e..40d3581d 100644
--- a/src/server/rz_server.py
+++ b/src/server/rz_server.py
@@ -2,12 +2,9 @@
 
 import argparse
 from flask import Flask
-from flask import Response
 from flask import redirect
 from flask import request
-from flask import send_from_directory
 from flask import session
-import flask
 from functools import wraps
 import logging
 import os
@@ -15,6 +12,7 @@ import re
 import signal
 
 import db_controller as dbc
+import rp
 import rz_api
 import rz_api_rest
 import rz_feedback
@@ -25,7 +23,6 @@ import rz_server_ctrl
 import rz_user
 import rz_blob
 from rz_user_db import User_DB
-import rz_api_common
 
 
 class Config(object):
@@ -199,7 +196,7 @@ def init_rest_interface(cfg, flask_webapp):
         """
         @wraps(f)
         def wrapped_function(*args, **kw):
-            if not 'username' in session:
+            if None == session.get('username'):
                 return redirect('/login')
             return f(*args, **kw)
 
diff --git a/src/server/rz_user.py b/src/server/rz_user.py
index 4eac4db3..44540f75 100644
--- a/src/server/rz_user.py
+++ b/src/server/rz_user.py
@@ -2,18 +2,16 @@ from datetime import datetime
 from datetime import timedelta
 from flask import current_app
 from flask import redirect
+from flask import make_response
 from flask import render_template
 from flask import request
 from flask import session
 from flask import url_for
-import flask
-import json
 import logging
 import re
 import uuid
 
 from crypt_util import hash_pw
-import crypt_util
 from rz_mail import send_email_message
 from rz_req_handling import make_response__json, make_response__json__html
 from rz_user_db import User_Account
@@ -164,8 +162,19 @@ def rest__logout():
     """
     # remove the username from the session if it's there
     u = session.pop('username', None)
+
+    assert None != u # assert user session was found - note: /logout is login protected
+
     log.debug('logout: success: user: %s' % (u))
-    return redirect(url_for('login'))
+
+    # redirect on GET, invalidate cookie on GET/POST
+    if request.method == 'GET':
+        resp = make_response(redirect(url_for('login')))
+    if request.method == 'POST':
+        resp = make_response__json()
+
+    resp.set_cookie(key='session', value='', expires=0) # UNIX timestamp 0
+    return resp
 
 def rest__pw_reset():
 
-- 
cgit v1.3.1