scratchfoundation/scratch-www
1
0
Fork 0
mirror of https://github.com/scratchfoundation/scratch-www.git synced 2025-02-17 00:21:20 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Use a dummy form submission instead of logging out via xhr.

Browse source 
This fixes an issue where you could get logged out but then remain on your page by dismissing the window.onbeforeunload prompt when you have unsaved changes. That would put you in a state where you looked logged in but could not save.
This commit is contained in:
Paul Kaplan 2019-02-11 10:08:38 -05:00
parent 16ca2d7319
commit 49afbd2c70
1 changed files with 16 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
src/redux/navigation.js
View file

@ -2,6 +2,7 @@ const keyMirror = require('keymirror');
const defaults = require('lodash.defaults');
const api = require('../lib/api');
const jar = require('../lib/jar');
const log = require('../lib/log.js');
const sessionActions = require('./session.js');
@ -138,16 +139,20 @@ module.exports.handleLogIn = (formData, callback) => (dispatch => {
});
});
module.exports.handleLogOut = () => (dispatch => {
api({
host: '',
method: 'post',
uri: '/accounts/logout/',
useCsrf: true
}, err => {
if (err) log.error(err);
dispatch(module.exports.setLoginOpen(false));
dispatch(module.exports.setAccountNavOpen(false));
window.location = '/';
module.exports.handleLogOut = () => (() => {
// POST to /accounts/logout using a dummy form instead of XHR. This ensures
// logout only happens AFTER onbeforeunload has the chance to prevent nagivation.
jar.use('scratchcsrftoken', '/csrf_token/', (err, csrftoken) => {
if (err) return log.error('Error while retrieving CSRF token', err);
const form = document.createElement('form');
form.setAttribute('method', 'POST');
form.setAttribute('action', '/accounts/logout/');
const csrfField = document.createElement('input');
csrfField.setAttribute('type', 'hidden');
csrfField.setAttribute('name', 'csrfmiddlewaretoken');
csrfField.setAttribute('value', csrftoken);
form.appendChild(csrfField);
document.body.appendChild(form);
form.submit();
});
});