Refined urltokens and XSRF protection

[project/luci.git] / modules / admin-full / luasrc / controller / admin / index.lua

diff --git a/modules/admin-full/luasrc/controller/admin/index.lua b/modules/admin-full/luasrc/controller/admin/index.lua
index 071dd59..e2b812e 100644 (file)
--- a/modules/admin-full/luasrc/controller/admin/index.lua
+++ b/modules/admin-full/luasrc/controller/admin/index.lua
@@ -49,6 +49,13 @@ function index()
 end
 
 function action_logout()
-       luci.http.header("Set-Cookie", "sysauth=; path=/")
+       local dsp = require "luci.dispatcher"
+       local sauth = require "luci.sauth"
+       if dsp.context.authsession then
+               sauth.kill(dsp.context.authsession)
+               dsp.context.urltoken.stok = nil
+       end
+
+       luci.http.header("Set-Cookie", "sysauth=; path=" .. dsp.build_url())
        luci.http.redirect(luci.dispatcher.build_url())
 end
\ No newline at end of file