Merge lp:~tkikuchi/mailman/logout-enforcement into lp:mailman/2.1

[Tokio Kikuchi]

Current 2.1 web interface for admindb has no function of 'logout'. Also, if the site set ALLOW_SITE_ADMIN_COOKIES Yes, the site-wide administrator cannot logout with the logout link in admin interface. This patch should fix the above inconvenience.

  1. Add Logout link in admindb pages (just before the mailman footer)
  2. Logout should be cared for site-wide admin and moderator.

[Mark Sapiro (msapiro)]

Thank you Tokio. I like the changes very much except for the appearance of the admindb 'Logout' link itself. I made it bigger and bold like the one on the admin pages and moved it to the right side of the page to make it stand out more. I will merge these changes into the base.

review: Approve (code)

=== modified file 'Mailman/Cgi/admin.py'
--- Mailman/Cgi/admin.py	2011-04-15 17:51:20 +0000
+++ Mailman/Cgi/admin.py	2011-04-22 02:32:25 +0000
@@ -107,6 +107,9 @@
 
     # Is this a log-out request?
     if category == 'logout':
+        # site-wide admin should also be able to logout.
+        if mlist.AuthContextInfo(mm_cfg.AuthSiteAdmin)[0] == 'site':
+            print mlist.ZapCookie(mm_cfg.AuthSiteAdmin)
         print mlist.ZapCookie(mm_cfg.AuthListAdmin)
         Auth.loginpage(mlist, 'admin', frontpage=1)
         return

=== modified file 'Mailman/Cgi/admindb.py'
--- Mailman/Cgi/admindb.py	2010-09-03 19:30:34 +0000
+++ Mailman/Cgi/admindb.py	2011-04-22 02:32:25 +0000
@@ -112,6 +112,19 @@
         Auth.loginpage(mlist, 'admindb', msg=msg)
         return
 
+    # Add logout function. Note that admindb may be accessed with
+    # site-wide admin, moderator and list admin privileges.
+    # site admin may have site or admin cookie. (or both?)
+    # See if this is a logout request
+    if len(parts) >= 2 and parts[1] == 'logout':
+        if mlist.AuthContextInfo(mm_cfg.AuthSiteAdmin)[0] == 'site':
+            print mlist.ZapCookie(mm_cfg.AuthSiteAdmin)
+        if mlist.AuthContextInfo(mm_cfg.AuthListModerator)[0]:
+            print mlist.ZapCookie(mm_cfg.AuthListModerator)
+        print mlist.ZapCookie(mm_cfg.AuthListAdmin)
+        Auth.loginpage(mlist, 'admindb', frontpage=1)
+        return
+
     # Set up the results document
     doc = Document()
     doc.set_language(mlist.preferred_language)
@@ -167,20 +180,23 @@
             process_form(mlist, doc, cgidata)
         # Now print the results and we're done.  Short circuit for when there
         # are no pending requests, but be sure to save the results!
+        admindburl = mlist.GetScriptURL('admindb', absolute=1)
         if not mlist.NumRequestsPending():
             title = _('%(realname)s Administrative Database')
             doc.SetTitle(title)
             doc.AddItem(Header(2, title))
             doc.AddItem(_('There are no pending requests.'))
             doc.AddItem(' ')
-            doc.AddItem(Link(mlist.GetScriptURL('admindb', absolute=1),
+            doc.AddItem(Link(admindburl,
                              _('Click here to reload this page.')))
+            # Put 'Logout' link before the footer
+            doc.AddItem('<br />\n')
+            doc.AddItem(Link('%s/logout' % admindburl, _('Logout')))
             doc.AddItem(mlist.GetMailmanFooter())
             print doc.Format()
             mlist.Save()
             return
 
-        admindburl = mlist.GetScriptURL('admindb', absolute=1)
         form = Form(admindburl)
         # Add the instructions template
         if details == 'instructions':
@@ -249,6 +265,9 @@
                     _('Discard all messages marked <em>Defer</em>')
                     ))
             form.AddItem(Center(SubmitButton('submit', _('Submit All Data'))))
+        # Put 'Logout' link before the footer
+        doc.AddItem('<br />\n')
+        doc.AddItem(Link('%s/logout' % admindburl, _('Logout')))
         doc.AddItem(mlist.GetMailmanFooter())
         print doc.Format()
         # Commit all changes