gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-10-30 02:59:03 +01:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

refactor: call logout route via JS

Browse Source 
required for csrf-csrf to correctly protect against
CSRF, as it required the _csrf cookie AND the
x-csrf-token HTTP header, the latter cannot be set
via simple Form POST action

using "../login" here, because "server" method is automatically prepending all paths with "/api",
which we don't want here, as we want "/login"
This commit is contained in:
Panagiotis Papadopoulos 2025-01-12 11:43:41 +01:00
parent c36085e580
commit 59ecc614c2
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/public/app/components/entrypoints.ts
View File

@ -114,11 +114,9 @@ export default class Entrypoints extends Component {
utils.reloadFrontendApp();
}
logoutCommand() {
const $logoutForm = $('<form action="logout" method="POST">').append($(`<input type='_hidden' name="_csrf" value="${glob.csrfToken}"/>`));
$("body").append($logoutForm);
$logoutForm.trigger("submit");
async logoutCommand() {
await server.post("../logout");
window.location.replace(`/login`);
}
backInNoteHistoryCommand() {