From 32c2f8217dcf647bddc79e9146562fc7c2dfd976 Mon Sep 17 00:00:00 2001
From: joyqi <magike.net@gmail.com>
Date: Sat, 16 Mar 2019 14:50:13 +0800
Subject: [PATCH] fix #845

---
 var/Widget/Logout.php  | 3 +++
 var/Widget/Options.php | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/var/Widget/Logout.php b/var/Widget/Logout.php
index a1b7d866..05ba5bca 100644
--- a/var/Widget/Logout.php
+++ b/var/Widget/Logout.php
@@ -28,6 +28,9 @@ class Widget_Logout extends Widget_Abstract_Users implements Widget_Interface_Do
      */
     public function action()
     {
+        // protect
+        $this->security->protect();
+
         $this->user->logout();
         $this->pluginHandle()->logout();
         $this->response->goBack(NULL, $this->options->index);
diff --git a/var/Widget/Options.php b/var/Widget/Options.php
index b24c3b60..7eda720d 100644
--- a/var/Widget/Options.php
+++ b/var/Widget/Options.php
@@ -251,7 +251,8 @@ class Widget_Options extends Typecho_Widget
      */
     protected function ___logoutUrl()
     {
-        return Typecho_Common::url('/action/logout', $this->index);
+        return $this->widget('Widget_Security')->getTokenUrl(
+            Typecho_Common::url('/action/logout', $this->index));
     }
 
     /**