#34022: admin:logout fails to log out non-staff users
-----------------------------------------+------------------------
Reporter: Jan Pazdziora | Owner: nobody
Type: Uncategorized | Status: new
Component: contrib.admin | Version: 4.1
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+------------------------
The Django 4.1 release notes at
https://docs.djangoproject.com/en/4.1/releases/4.1/ show that the expected
way to log out users is using **admin:logout**:
{{{
<form id="logout-form" method="post" action="{% url 'admin:logout' %}">
{% csrf_token %}
<button type="submit">{% translate "Log out" %}</button>
</form>
}}}
However, when the logged-in user does not have the is_staff attribute
because it used a custom non-admin login, using such approach leads to a
redirect back to /admin/ and /admin/login/?next=/admin/ and message
You are authenticated as bob, but are not authorized to access this
page.
Would you like to login to a different account?
Since the user tries to log out, meaning strip themselves of any
permissions, the authorization check that is currently in place for logout
is likely wrong.
The behaviour change happened in
https://github.com/django/django/commit/1f84630c87f8032b0167e6db41acaf50ab710879.
The original code did
{{{
# The 'logout' view doesn't require that the person is logged in.
if url == 'logout':
return self.logout(request)
# Check permission to continue or display login form.
if not self.has_permission(request):
return self.login(request)
}}}
which the new code changed to
{{{
url(r'^logout/$',
wrap(self.logout),
name='%sadmin_logout'),
}}}
with that {{{wrap()}}} around {{{self.logout}}}. So that refactoring
change also changed the semantics of the logout behaviour
--
Ticket URL: <https://code.djangoproject.com/ticket/34022>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/0107018354304fdf-01c42bbd-a679-45fd-a57d-c7cb8f620a60-000000%40eu-central-1.amazonses.com.
