Repository: freedomofpress/securedrop

Issue:
Logout message in localized language and landing page in default language
# Bug
## Description

A source logging out of session in non-default language may yield a home page that has different languages. 

## Steps to Reproduce

0. SecureDrop instance must support more than 1 language
1. Navigate to source interface
2. Change to another language
2. Click on submit document (or equivalent)Change language to non-default language 
4. Logout
5. Observe multilingual SecureDrop login page (Session Ending box in chosen language, Landing page in default language

## Expected Behavior

Logout should preserve user's language settings ?

## Actual Behavior

The session settings are cleared and the user's language selection is not preserved


Logout message in localized language and landing page in default language
# Bug
## Description

A source logging out of session in non-default language may yield a home page that has different languages. 

## Steps to Reproduce

0. SecureDrop instance must support more than 1 language
1. Navigate to source interface
2. Change to another language
2. Click on submit document (or equivalent)Change language to non-default language 
4. Logout
5. Observe multilingual SecureDrop login page (Session Ending box in chosen language, Landing page in default language

## Expected Behavior

Logout should preserve user's language settings ?

## Actual Behavior

The session settings are cleared and the user's language selection is not preserved




Discussion:
![screenshot from 2017-11-30 16-29-26](https://user-images.githubusercontent.com/15223328/33455946-a9d4a0b8-d5eb-11e7-9a00-2ecc553dd41e.png)

This behavior does not happen on the journalist interface.
We could make it so the logout redirects to the index page with **l=de_DE** to preserve the language. @redshiftzero if you agree that's a desirable solution I'll propose a pull request.
This is happening because when we log out we use `session.clear()` on the source interface and `session.pop('uid', None)` and `session.pop('expires', None)` on the journalist interface
![screenshot from 2017-11-30 16-29-26](https://user-images.githubusercontent.com/15223328/33455946-a9d4a0b8-d5eb-11e7-9a00-2ecc553dd41e.png)

This behavior does not happen on the journalist interface.
We could make it so the logout redirects to the index page with **l=de_DE** to preserve the language. @redshiftzero if you agree that's a desirable solution I'll propose a pull request.
This is happening because when we log out we use `session.clear()` on the source interface and `session.pop('uid', None)` and `session.pop('expires', None)` on the journalist interface

Resolving patch:
diff --git a/securedrop/source_app/main.py b/securedrop/source_app/main.py
--- a/securedrop/source_app/main.py
+++ b/securedrop/source_app/main.py
@@ -221,8 +221,11 @@ def logout():
         if logged_in():
             msg = render_template('logout_flashed_message.html')
 
-            # clear the session after we render the message so it's localized
+            # Clear the session after we render the message so it's localized
+            # If a user specified a locale, save it and restore it
+            user_locale = g.locale
             session.clear()
+            session['locale'] = user_locale
 
             flash(Markup(msg), "important hide-if-not-tor-browser")
         return redirect(url_for('.index'))


Test patch:
diff --git a/securedrop/tests/test_source.py b/securedrop/tests/test_source.py
--- a/securedrop/tests/test_source.py
+++ b/securedrop/tests/test_source.py
@@ -194,7 +194,9 @@ def test_login_and_logout(self):
 
             # sessions always have 'expires', so pop it for the next check
             session.pop('expires', None)
-            self.assertTrue(not session)
+
+            self.assertNotIn('logged_in', session)
+            self.assertNotIn('codename', session)
 
             self.assertIn('Thank you for exiting your session!', resp.data)