diff --git a/wagtail/wagtailadmin/templates/wagtailadmin/shared/main_nav.html b/wagtail/wagtailadmin/templates/wagtailadmin/shared/main_nav.html index 08707c3e5..17cd3e1d1 100644 --- a/wagtail/wagtailadmin/templates/wagtailadmin/shared/main_nav.html +++ b/wagtail/wagtailadmin/templates/wagtailadmin/shared/main_nav.html @@ -12,7 +12,7 @@ {% endcomment %} {% if request.user.is_superuser %} {# for now, 'More' links will be superuser-only #}
  • diff --git a/wagtail/wagtailadmin/urls.py b/wagtail/wagtailadmin/urls.py index 081337803..3b1a98535 100644 --- a/wagtail/wagtailadmin/urls.py +++ b/wagtail/wagtailadmin/urls.py @@ -13,7 +13,6 @@ urlpatterns = patterns( 'extra_context': {'show_password_reset': getattr(settings, 'WAGTAIL_PASSWORD_MANAGEMENT_ENABLED', True)}, } , name='wagtailadmin_login' ), - url(r'^logout/$', 'logout', {'next_page': 'wagtailadmin_login'}), # Password reset url( @@ -79,6 +78,7 @@ urlpatterns += patterns( url(r'^account/$', 'account.account', name='wagtailadmin_account'), url(r'^account/change_password/$', 'account.change_password', name='wagtailadmin_account_change_password'), + url(r'^logout/$', 'account.logout', name='wagtailadmin_logout'), url(r'^userbar/(\d+)/$', 'userbar.for_frontend', name='wagtailadmin_userbar_frontend'), url(r'^userbar/moderation/(\d+)/$', 'userbar.for_moderation', name='wagtailadmin_userbar_moderation'), diff --git a/wagtail/wagtailadmin/views/account.py b/wagtail/wagtailadmin/views/account.py index bfd2df7c7..8479ea6b0 100644 --- a/wagtail/wagtailadmin/views/account.py +++ b/wagtail/wagtailadmin/views/account.py @@ -3,6 +3,7 @@ from django.shortcuts import render, redirect from django.contrib import messages from django.contrib.auth.forms import SetPasswordForm from django.contrib.auth.decorators import permission_required +from django.contrib.auth.views import logout as auth_logout from django.utils.translation import ugettext as _ @permission_required('wagtailadmin.access_admin') @@ -34,3 +35,20 @@ def change_password(request): 'form': form, 'can_change_password': can_change_password, }) + + +def logout(request): + response = auth_logout(request, next_page = 'wagtailadmin_login') + + # By default, logging out will generate a fresh sessionid cookie. We want to use the + # absence of sessionid as an indication that front-end pages are being viewed by a + # non-logged-in user and are therefore cacheable, so we forcibly delete the cookie here. + response.delete_cookie(settings.SESSION_COOKIE_NAME, + domain=settings.SESSION_COOKIE_DOMAIN, + path=settings.SESSION_COOKIE_PATH) + + # HACK: pretend that the session hasn't been modified, so that SessionMiddleware + # won't override the above and write a new cookie. + request.session.modified = False + + return response