WordPress.org

Make WordPress Core

Opened 8 months ago

Last modified 4 months ago

#22254 new defect (bug)

"Do you really want to log out" message after already logged out

Reported by: Ov3rfly Owned by:
Priority: normal Milestone: Awaiting Review
Component: Administration Version: 3.4.2
Severity: normal Keywords: has-patch
Cc: mdhansen@…

Description

  1. Log into admin area
  2. Open some page within admin area in a new tab (middle click or "Open link in new tab" or similar)
  3. Select "Log Out" in menu in one tab
  4. Normal "You are now logged out." screen appears
  5. Select "Log Out" in menu in other tab
  6. The following message appears:
    You are attempting to log out of Blogname
    
    Do you really want to log out?
    

The content of this message is wrong as the user is already logged out at this point.

Attachments (1)

22254.diff (625 bytes) - added by MikeHansenMe 8 months ago.
send logged out user straight to login form

Download all attachments as: .zip

Change History (12)

MikeHansenMe8 months ago

send logged out user straight to login form

comment:1 MikeHansenMe8 months ago

  • Cc mdhansen@… added

comment:2 SergeyBiryukov8 months ago

  • Keywords has-patch added

comment:3 MikeHansenMe5 months ago

  • Keywords needs-testing added

comment:4 SergeyBiryukov5 months ago

  • Milestone changed from Awaiting Review to 3.6

comment:5 aaronholbrook5 months ago

Tested, worked great.

comment:6 bradparbs5 months ago

  • Keywords needs-testing removed

Works for me as well.

comment:7 MikeHansenMe5 months ago

Thanks for testing the patch guys

comment:8 SergeyBiryukov4 months ago

  • Keywords commit added

comment:9 nacin4 months ago

Partial duplicate of #14949?

comment:10 nacin4 months ago

A few things:

  • I don't think this is the right place for this code. Rather than going in wp_nonce_ays() — where messages for failed nonces get printed — the nonce check should be avoided all together, in wp-login.php's action = logout branch.
  • I'm not sure this is necessary at all. The user may be "logged out" by having the logged_in cookie drop, but they may still have admin cookies and it would be good for those to be removed. By providing an extra step, we can ensure that they have an opportunity to explicitly log out and remove all cookies.
  • For more, see #14949, which covers the logging-in-when-already-logged-in problem. This is just the reverse — logging out when already logged out.

comment:11 nacin4 months ago

  • Keywords commit removed
  • Milestone changed from 3.6 to Awaiting Review
Note: See TracTickets for help on using tickets.