From 41c84d4c2e8cda73baf0000e388575790d93dff0 Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Thu, 1 Oct 2009 16:50:04 +0400
Subject: [PATCH] * login and logout are available now only via POST query

---
 src/ajax.js  | 8 +++-----
 src/ajax.php | 4 ++--
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/ajax.js b/src/ajax.js
index 1ec7f5f..bd3d5f0 100644
--- a/src/ajax.js
+++ b/src/ajax.js
@@ -463,8 +463,7 @@ function updateAccessStatus()
 function doAuth(form)
 {
 	setAjaxErrorTrigger();
-	var nocache = '&rnd='+Math.random();
-	$.post('ajax.php?login'+nocache, { password: form.password.value }, function(json){
+	$.post('ajax.php?rnd='+Math.random(), { login:1, password: form.password.value }, function(json){
 		resetAjaxErrorTrigger();
 		form.password.value = '';
 		if(json.logged)
@@ -484,10 +483,9 @@ function doAuth(form)
 function logout()
 {
 	setAjaxErrorTrigger();
-	var nocache = '&rnd='+Math.random();
-	$.getJSON('ajax.php?logout'+nocache, function(json){
+	$.post('ajax.php?rnd='+Math.random(), { logout:1 }, function(json){
 		resetAjaxErrorTrigger();
-	});
+	}, 'json');
 	flag.isLogged = false;
 	updateAccessStatus();
 	if(flag.canAllRead) {
diff --git a/src/ajax.php b/src/ajax.php
index 895cbf4..7955dc4 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -234,7 +234,7 @@ elseif(isset($_GET['changeOrder']))
 	echo json_encode($t);
 	exit;
 }
-elseif(isset($_GET['login']))
+elseif(isset($_POST['login']))
 {
 	$t = array('logged' => 0);
 	if(!$needAuth) {
@@ -252,7 +252,7 @@ elseif(isset($_GET['login']))
 	echo json_encode($t);
 	exit;
 }
-elseif(isset($_GET['logout']))
+elseif(isset($_POST['logout']))
 {
 	$_SESSION = array();
 	$t = array('logged' => 0);