fix #845

var/Widget/Logout.php

@@ -28,6 +28,9 @@ class Widget_Logout extends Widget_Abstract_Users implements Widget_Interface_Do
      */
     public function action()
     {
+        // protect
+        $this->security->protect();
+
         $this->user->logout();
         $this->pluginHandle()->logout();
         $this->response->goBack(NULL, $this->options->index);

var/Widget/Options.php

@@ -251,7 +251,8 @@ class Widget_Options extends Typecho_Widget
      */
     protected function ___logoutUrl()
     {
-        return Typecho_Common::url('/action/logout', $this->index);
+        return $this->widget('Widget_Security')->getTokenUrl(
+            Typecho_Common::url('/action/logout', $this->index));
     }
 
     /**