Use POST instead of GET for logging out (#13022).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@11289 e93f8b46-1217-0410-a6f0-8f06a7374b81

test/functional/account_controller_test.rb

@@ -80,9 +80,18 @@ class AccountControllerTest < ActionController::TestCase
     assert_response 302
   end
 
-  def test_logout
+  def test_get_logout_should_not_logout
     @request.session[:user_id] = 2
     get :logout
+    assert_response :success
+    assert_template 'logout'
+
+    assert_equal 2, @request.session[:user_id]
+  end
+
+  def test_logout
+    @request.session[:user_id] = 2
+    post :logout
     assert_redirected_to '/'
     assert_nil @request.session[:user_id]
   end
@@ -91,7 +100,7 @@ class AccountControllerTest < ActionController::TestCase
     @controller.expects(:reset_session).once
 
     @request.session[:user_id] = 2
-    get :logout
+    post :logout
     assert_response 302
   end