diff --git a/openlibrary/accounts/model.py b/openlibrary/accounts/model.py index ce526b86a8b..7f0126942e7 100644 --- a/openlibrary/accounts/model.py +++ b/openlibrary/accounts/model.py @@ -128,6 +128,11 @@ def create_link_doc(key, username, email): } +def clear_cookies(): + web.setcookie('pd', "", expires=-1) + web.setcookie('sfw', "", expires=-1) + + class Link(web.storage): def get_expiration_time(self): d = self['expires_on'].split(".")[0] diff --git a/openlibrary/plugins/admin/code.py b/openlibrary/plugins/admin/code.py index d6192bf5b0d..8b20f988af0 100644 --- a/openlibrary/plugins/admin/code.py +++ b/openlibrary/plugins/admin/code.py @@ -25,6 +25,7 @@ import openlibrary from openlibrary import accounts +from openlibrary.accounts.model import clear_cookies from openlibrary.accounts.model import OpenLibraryAccount from openlibrary.core import admin as admin_stats, helpers as h, imports, cache from openlibrary.core.waitinglist import Stats as WLStats @@ -465,7 +466,10 @@ def POST_set_bot_flag(self, account, bot): def POST_su(self, account): code = account.generate_login_code() + # Clear all existing admin cookies before logging in as another user + clear_cookies() web.setcookie(config.login_cookie_name, code, expires="") + return web.seeother("/") def POST_anonymize_account(self, account, test): diff --git a/openlibrary/plugins/upstream/account.py b/openlibrary/plugins/upstream/account.py index 5e1425b6dfd..3dd96f954ee 100644 --- a/openlibrary/plugins/upstream/account.py +++ b/openlibrary/plugins/upstream/account.py @@ -36,6 +36,7 @@ OpenLibraryAccount, InternetArchiveAccount, valid_email, + clear_cookies, ) from openlibrary.plugins.upstream import borrow, forms, utils from openlibrary.utils.dateutil import elapsed_time @@ -434,6 +435,23 @@ def POST_resend_verification_email(self, i): return render.message(title, message) +class account_logout(delegate.page): + """Account logout. + + This registers a handler to the /account/logout endpoint in infogami so that additional logic, such as clearing admin cookies, + can be handled prior to the calling of infogami's standard logout procedure + + """ + + path = "/account/logout" + + def POST(self): + clear_cookies() + from infogami.core.code import logout as infogami_logout + + return infogami_logout().POST() + + class account_verify(delegate.page): """Verify user account."""