Changeset 2756 for branches/2.0/include/user.inc.php

Timestamp:

Oct 16, 2008, 2:35:30 AM (16 years ago)

Author:

rvelices

Message:

• security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)

File:

• branches/2.0/include/user.inc.php (modified) (1 diff)

branches/2.0/include/user.inc.php

@@ -30 +30 @@
   if (isset($_GET['act']) and $_GET['act'] == 'logout')
   { // logout
-    $_SESSION = array();
-    session_unset();
-    session_destroy();
-    setcookie(session_name(),'',0,
-        ini_get('session.cookie_path'),
-        ini_get('session.cookie_domain')
-      );
-    setcookie($conf['remember_me_name'], '', 0, cookie_path());
+    logout_user();
     redirect(make_index_url());
   }