From b3d73bdd7a1c2c392bfb7b645991451c2b5bd79b Mon Sep 17 00:00:00 2001 From: Moetaz Date: Mon, 8 Oct 2018 13:55:51 +0100 Subject: [PATCH] removed unusable endpoint when ACCOUNT_LOGOUT_ON_GET==False This commit removes the GET method from the LogoutView when ACCOUNT_LOGOUT_ON_GET==False. Before this commit, the logout endpoint accepts GET requests and appears in the [auto-generated DRF docs](https://bit.ly/2OMpwKx), but it's not usable. --- rest_auth/views.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/rest_auth/views.py b/rest_auth/views.py index 8efcdd5..c1e1856 100644 --- a/rest_auth/views.py +++ b/rest_auth/views.py @@ -105,12 +105,13 @@ class LogoutView(APIView): """ permission_classes = (AllowAny,) - def get(self, request, *args, **kwargs): - if getattr(settings, 'ACCOUNT_LOGOUT_ON_GET', False): - response = self.logout(request) - else: - response = self.http_method_not_allowed(request, *args, **kwargs) + def __init__(self): + if getattr(settings, 'ACCOUNT_LOGOUT_ON_GET', True): + self.get = self._get + super().__init__() + def _get(self, request, *args, **kwargs): + response = self.logout(request) return self.finalize_response(request, response, *args, **kwargs) def post(self, request, *args, **kwargs):