diff --git a/news/1303.feature b/news/1303.feature new file mode 100644 index 0000000000..7100014e67 --- /dev/null +++ b/news/1303.feature @@ -0,0 +1,2 @@ +Logging in to or out of Plone classic or the API does the same in the other. +[rpatterson] diff --git a/src/plone/restapi/services/auth/login.py b/src/plone/restapi/services/auth/login.py index b0d65c6648..b51962dcb9 100644 --- a/src/plone/restapi/services/auth/login.py +++ b/src/plone/restapi/services/auth/login.py @@ -28,8 +28,10 @@ def reply(self): if "IDisableCSRFProtection" in dir(plone.protect.interfaces): alsoProvides(self.request, plone.protect.interfaces.IDisableCSRFProtection) - userid = data["login"] - password = data["password"] + # Also add credentials to the request for other code that depends on it. In + # particular, the PAS cookie authentication plugin depends on `__ac_password`. + userid = self.request.form["__ac_name"] = data["login"] + password = self.request.form["__ac_password"] = data["password"] uf = self._find_userfolder(userid) if uf is not None: