From: Mark Wooding <mdw@distorted.org.uk>
Date: Thu, 23 Jan 2014 19:05:23 +0000 (+0000)
Subject: list.fhtml: Make `logout' be a POST operation.
X-Git-Tag: 1.0.3~12
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~mdw/git/chopwood/commitdiff_plain/b5fb855f1d152ef0c52d579b96c006a63e77fd10

list.fhtml: Make `logout' be a POST operation.

It's really not idempotent.  And also it will spam the CSRF token into
the URL, which isn't what we want.
---

diff --git a/list.fhtml b/list.fhtml
index 0fb5faf..8a947aa 100644
--- a/list.fhtml
+++ b/list.fhtml
@@ -130,7 +130,7 @@
 
 <h2>Log out of Chopwood</h2>
 
-<form method=GET action="~={script}H/logout">
+<form method=POST action="~={script}H/logout">
 <button type=submit>Log out</button>
 <input type=hidden name=%user value="~={user}H">
 <input type=hidden name=%nonce value="~={nonce}H">