Skip to content

Commit

Permalink
refactor: migrated logout to controller (#3257)
Browse files Browse the repository at this point in the history
  • Loading branch information
thorsten committed Dec 28, 2024
1 parent 004e7b6 commit 0f43907
Show file tree
Hide file tree
Showing 7 changed files with 53 additions and 6 deletions.
2 changes: 1 addition & 1 deletion nginx.conf
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ server {
rewrite admin/api/(.*) /admin/api/index.php last;

# Administration pages
rewrite admin/(attachments|backup|category|comments|configuration|elasticsearch|export|faq|faqs|forms|glossary|group|import|instance|instances|media-browser|news|password|questions|session-keep-alive|statistics|sticky-faqs|stopwords|system|tags|update|user) /admin/front.php last;
rewrite admin/(attachments|backup|category|comments|configuration|elasticsearch|export|faq|faqs|forms|glossary|group|import|instance|instances|logout|media-browser|news|password|questions|session-keep-alive|statistics|sticky-faqs|stopwords|system|tags|update|user) /admin/front.php last;

# REST API v3.0 and v3.1
rewrite ^api/v3\.[01]/(.*) /api/index.php last;
Expand Down
3 changes: 2 additions & 1 deletion phpmyfaq/.htaccess
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,8 @@ Header set Access-Control-Allow-Headers "Content-Type, Authorization"
# Administration API
RewriteRule ^admin/api/(.*) admin/api/index.php [L,QSA]
# Administration pages
RewriteRule ^admin/(attachments|backup|category|comments|configuration|elasticsearch|export|faq|faqs|forms|glossary|group|import|instance|instances|media-browser|news|password|questions|session-keep-alive|statistics|sticky-faqs|stopwords|system|tags|update|user) admin/front.php [L,QSA]
RewriteRule ^admin/(attachments|backup|category|comments|configuration|elasticsearch|export|faq|faqs|forms|glossary|group|import|instance|instances|logout|media-browser|news|password|questions|session-keep-alive|statistics|sticky-faqs|stopwords|system|tags|update|user) admin/front.php [L,QSA]
#RewriteRule ^admin/(.*) admin/front.php [L,QSA]
# Private APIs
RewriteRule ^api/(autocomplete|bookmark/delete|bookmark/create|user/data/update|user/password/update|user/request-removal|user/remove-twofactor|contact|voting|register|captcha|share|comment/create|faq/create|question/create|webauthn/prepare|webauthn/register|webauthn/prepare-login|webauthn/login) api/index.php [L,QSA]
# Setup APIs
Expand Down
4 changes: 2 additions & 2 deletions phpmyfaq/assets/templates/admin/header.twig
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@
</li>
<li><hr class="dropdown-divider"></li>
<li>
<a class="dropdown-item" href="index.php?action=logout&csrf={{ csrfTokenLogout }}">{{ msgLogout }}</a>
<a class="dropdown-item" href="./logout?csrf={{ csrfTokenLogout }}">{{ msgLogout }}</a>
</li>
</ul>
</li>
Expand All @@ -99,7 +99,7 @@
<div class="nav">

<!-- Dashboard -->
<a class="nav-link" href="index.php">
<a class="nav-link" href="./">
<div class="pmf-admin-nav-link-icon"><i class="bi bi-speedometer h6"></i></div>
Dashboard
</a>
Expand Down
2 changes: 1 addition & 1 deletion phpmyfaq/assets/templates/admin/index.twig
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@
</li>
<li><hr class="dropdown-divider"></li>
<li>
<a class="dropdown-item" href="index.php?action=logout&csrf={{ csrfTokenLogout }}">{{ msgLogout }}</a>
<a class="dropdown-item" href="./logout?csrf={{ csrfTokenLogout }}">{{ msgLogout }}</a>
</li>
</ul>
</li>
Expand Down
2 changes: 1 addition & 1 deletion phpmyfaq/assets/templates/admin/session-keepalive.twig
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
const duration = expire - sessionStart;
if (duration <= 0) {
parent.location.href = './index.php?action=logout&csrf={{ csrfToken }}';
parent.location.href = './logout?csrf={{ csrfToken }}';
return;
}
Expand Down
6 changes: 6 additions & 0 deletions phpmyfaq/src/admin-routes.php
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@

use phpMyFAQ\Controller\Administration\AdminLogController;
use phpMyFAQ\Controller\Administration\AttachmentsController;
use phpMyFAQ\Controller\Administration\AuthenticationController;
use phpMyFAQ\Controller\Administration\BackupController;
use phpMyFAQ\Controller\Administration\CategoryController;
use phpMyFAQ\Controller\Administration\CommentsController;
Expand Down Expand Up @@ -55,6 +56,11 @@
'controller' => [AttachmentsController::class, 'index'],
'methods' => 'GET'
],
'admin.auth.logout' => [
'path' => '/logout',
'controller' => [AuthenticationController::class, 'logout'],
'methods' => 'GET'
],
'admin.backup' => [
'path' => '/backup',
'controller' => [BackupController::class, 'index'],
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
<?php

declare(strict_types=1);

namespace phpMyFAQ\Controller\Administration;

use phpMyFAQ\Filter;
use phpMyFAQ\Session\Token;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;

class AuthenticationController extends AbstractAdministrationController
{
/**
* @throws \Exception
*/
#[Route('/logout', name: 'admin.auth.logout', methods: ['GET'])]
public function logout(Request $request): Response
{
$this->userIsAuthenticated();

$redirect = new RedirectResponse('./');

$csrfToken = Filter::filterVar($request->get('csrf'), FILTER_SANITIZE_SPECIAL_CHARS);
if (!Token::getInstance($this->container->get('session'))->verifyToken('admin-logout', $csrfToken)) {
return $redirect->send();
}

$this->currentUser->deleteFromSession(true);
$ssoLogout = $this->configuration->get('security.ssoLogoutRedirect');
if ($this->configuration->get('security.ssoSupport') && !empty($ssoLogout)) {
$redirect->isRedirect($ssoLogout);
$redirect->send();
}

return $redirect->send();
}
}

0 comments on commit 0f43907

Please sign in to comment.