Tickets :: Comment on [#8331] shall we need a token for logout?

* Your Email Address
* Spam protection	Enter the letters below: .__ .___.. .. ..__. [__) _/ \|_/ \|\ \|\| \| \| \./__.\| \\| \\|\|__\|
Comment	> We are using a CAS SSO. To logout all user applications, we produce > page with iframes pointing to logout URLs > > > > As there is now a token for logout action, we can't log out users. > > > > I patched login.php: > > > > Shall we consider that we must protect the logout form. What can be > an attack using logout form? For me: nothing.. > > > > root@ent1:/var/www/perso# diff -u -p horde/login.php.org horde/login.php > > --- horde/login.php.org 2009-06-08 16:27:27.000000000 +0200 > > +++ horde/login.php 2009-06-08 16:26:51.000000000 +0200 > > @@ -60,12 +60,6 @@ if (($pos = strrpos($url_in, '#')) !== f > > } > > > > if ($logout_reason) { > > - if (Auth::getAuth()) { > > - $result = Horde::checkRequestToken('horde.logout', > Util::getFormData('horde_logout_token')); > > - if (is_a($result, 'PEAR_Error')) { > > - exit($result->getMessage()); > > - } > > - } > > > > $login_screen = $auth->getLoginScreen(); > > if (Util::getFormData('nosidebar') && > > > > > >
Attachment
Watch this ticket