From 19cae36a44003f00c64eb1687a81d52490499c45 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 18 Sep 2023 16:42:28 +0200 Subject: [PATCH] appstore: add usermenu with logout option --- store/app.py | 16 ++++++++++ store/templates/base.html | 67 +++++++++++++++++++++++++-------------- 2 files changed, 60 insertions(+), 23 deletions(-) diff --git a/store/app.py b/store/app.py index b6c09cc..9d9ae36 100644 --- a/store/app.py +++ b/store/app.py @@ -284,6 +284,22 @@ def sso_login_callback(): @app.route('/logout') def logout(): session.clear() + + # Only use the current referer URI if it's on the same domain as the current route + # to avoid XSS or whatever... + referer = request.environ.get("HTTP_REFERER") + if referer: + if referer.startswith("http://"): + referer = referer[len("http://"):] + if referer.startswith("https://"): + referer = referer[len("https://"):] + if "/" not in referer: + referer = referer + "/" + + domain, uri = referer.split("/", 1) + if domain == request.environ.get("HTTP_HOST"): + return redirect("/" + uri) + return redirect("/") diff --git a/store/templates/base.html b/store/templates/base.html index 7c61049..7823da0 100644 --- a/store/templates/base.html +++ b/store/templates/base.html @@ -91,30 +91,42 @@ {{ _("Login using YunoHost's forum") }} {% else %} - - +
+ + +
{% endif %} + + +