Version 4.3.0

applications/cms/hooks/Output.php

@@ -25,11 +25,18 @@ class cms_hook_Output extends _HOOK_CLASS_
 		{
 			parent::error( $message, $code, $httpStatusCode, $adminMessage, $httpHeaders, $extra, $faultyAppOrHookId );
 		}
-		
-		/* If we just logged out, we don't want to show a "no permission" error */
+
+		/* When we log out, the user is taken back to the page they were just on. If this is producing a "no permission" error, redirect them to the index instead */
 		if ( isset( \IPS\Request::i()->_fromLogout ) )
 		{
-			$this->redirect( \IPS\Http\Url::internal('')->stripQueryString()->setQueryString( '_fromLogout', 1 ) );
+			// _fromLogout=1 indicates that they came from log out. To make sure that we don't cause an infinite redirect (which
+			// would happen if guests cannot view the index page) we need to change _fromLogout, but we can't unset it because _fromLogout={anything}
+			// will clear the autosave content on next load (by Javascript), which we need to do on log out for security reasons... so, _fromLogout=2
+			// is used here which will clear the autosave, but *not* redirect them again
+			if ( \IPS\Request::i()->_fromLogout != 2 )
+			{
+				$this->redirect( \IPS\Http\Url::internal('')->stripQueryString()->setQueryString( '_fromLogout', 2 ) );
+			}
 		}
 		
 		/* If we're in an external script, just show a simple message */