1 # ===================================================================== 2 # logOut: revoke user's authentication credentials. 3 # 4 # Copyright (c) 2005-2014 Carlo Strozzi 5 # 6 # This program is free software; you can redistribute it and/or modify 7 # it under the terms of the GNU General Public License as published by 8 # the Free Software Foundation; version 2 dated June, 1991. 9 # 10 # This program is distributed in the hope that it will be useful, 11 # but WITHOUT ANY WARRANTY; without even the implied warranty of 12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 # GNU General Public License for more details. 14 # 15 # You should have received a copy of the GNU General Public License 16 # along with this program; if not, write to the Free Software 17 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 18 # 19 # ===================================================================== 20 21 # ===================================================================== 22 # Local variables and functions 23 # ===================================================================== 24 25 TNS_GROUP_HOME = () 26 27 cgi.group = () 28 cgi.group.literal = () 29 30 # ===================================================================== 31 # Main program 32 # ===================================================================== 33 34 csaGetArgs DELETE 35 36 # For security, log-out the user first, as this has to be done anyway, 37 # and only afterwards perform further operations. 38 39 csaSession.set - 1 # userid 40 csaSession.set - 2 # login time. 41 csaSession.set - 9 # auth group. 42 csaSession.set - 13 # Own e-mail address. 43 csaSession.set - 15 # OpenID URL, if any. 44 45 csaCookie.set twauthor $nil 46 47 HTTP_AUTHORIZATION = 'Basic Cg==' # This is *mandatory* 48 49 # Check the single most important arg. Note that this may be missing in 50 # some cases, namely when the user logs-out on a PRG-served page, so I 51 # need to provide a back-up strategy to assess what group the user was 52 # working with, and I do it with a session token. See also the notes 53 # regarding the session DELETE action in 'rest.map'. 54 55 if (~ $'cgi.group' ()) { 56 ~ $CSA_SESSION(12) () && csaExit.fault 1000 57 cgi.group = $CSA_SESSION(12) 58 } 59 60 . $CSA_ROOT/lib/group-stuff.rc 61 62 ~ $#TNS_GROUP_HOME 1 2 || csaExit.fault 0041 TNS_GROUP_HOME # required 63 64 # Follow the specs. 65 ~ $TNS_GROUP_HOME(2) () && 66 TNS_GROUP_HOME = ($TNS_GROUP_HOME(1) $TNS_GROUP_HOME(1)) 67 68 # Remove also any additional files associated with the current session, 69 # also to effectively log-out any slave weblets. 70 71 ~ $CSA_SESSION(19) tag:* && 72 csaTrapFile $TMPDIR/$CSA_SESSION(19)^-* 73 74 # Make sure the static session file is also removed, just in case. 75 ~ $CSA_OLDSES_PROP(3) reuse && ~ $CSA_OLDSES_PROP(2) /* && 76 csaIsFullPath --exists --quiet $CSA_OLDSES_PROP(2) && 77 csaTrapFile $CSA_OLDSES_PROP(2) 78 79 # This is supposed NOT to survive the logout action, as per the TW specs. 80 csaSession.set - 19 81 82 csaSession.set - 17 # Misc. housekeeping. 83 84 # These should not survive across sessions either or they 85 # may behave oddly and be misleading for the user. 86 87 csaSession.set - 11 # Preferred edit GUI. 88 csaSession.set - 18 89 90 # Let's clear Avatar stuff, too. 91 csaSession.set - 21 92 93 # Take the now logged-out user back to the welcome page. 94 95 csaExit.location \ 96 $CSA_RPC_URI/$CSA_LANG/$'cgi.group'/$TNS_GROUP_HOME(2) 97 98 # End of program.