Refs #3791@2h; fixes cas_extra_attributes= and redirects correctly; still missing flash message

1 files changed, 7 insertions, 3 deletions

diff --git a/app/controllers/devise/cas_sessions_controller.rb b/app/controllers/devise/cas_sessions_controller.rb
index 0a9d9ecb2..d000d0309 100644
--- a/app/controllers/devise/cas_sessions_controller.rb
+++ b/app/controllers/devise/cas_sessions_controller.rb
@@ -20,14 +20,14 @@ class Devise::CasSessionsController < Devise::SessionsController
     if LoginPolicy.new(current_user).boiv?
       redirect_to after_sign_in_path_for(current_user)
     else
-      redirect_to root_path, flash: {alert: t('devise.sessions.new.unauthorized')}
+      destroy message: t('devise.sessions.new.unauthorized')
     end
   end
 
   def unregistered
   end
 
-  def destroy
+  def destroy message: nil
     # if :cas_create_user is false a CAS session might be open but not signed_in
     # in such case we destroy the session here
     if signed_in?(resource_name)
@@ -36,7 +36,11 @@ class Devise::CasSessionsController < Devise::SessionsController
       reset_session
     end
 
-    redirect_to(cas_logout_url)
+    if message
+      redirect_to(cas_logout_url, flash: {alert: message})
+    else
+      redirect_to(cas_logout_url)
+    end
   end
 
   def single_sign_out