aboutsummaryrefslogtreecommitdiffstats
path: root/include/user.inc.php
diff options
context:
space:
mode:
authorrvelices <rv-github@modusoptimus.com>2008-10-16 00:35:30 +0000
committerrvelices <rv-github@modusoptimus.com>2008-10-16 00:35:30 +0000
commitf7f8c1688ef30ecb2f40fe279ba34d250d4ec8be (patch)
tree8d6fde76195c05586163fd33ed9df706367c30aa /include/user.inc.php
parent7807d6586a198c75e3d4f72c4b360bee061b817f (diff)
- security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others)
git-svn-id: http://piwigo.org/svn/branches/2.0@2756 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to '')
-rw-r--r--include/user.inc.php9
1 files changed, 1 insertions, 8 deletions
diff --git a/include/user.inc.php b/include/user.inc.php
index 9d7d2f242..0084a3aff 100644
--- a/include/user.inc.php
+++ b/include/user.inc.php
@@ -29,14 +29,7 @@ if (isset($_COOKIE[session_name()]))
session_start();
if (isset($_GET['act']) and $_GET['act'] == 'logout')
{ // logout
- $_SESSION = array();
- session_unset();
- session_destroy();
- setcookie(session_name(),'',0,
- ini_get('session.cookie_path'),
- ini_get('session.cookie_domain')
- );
- setcookie($conf['remember_me_name'], '', 0, cookie_path());
+ logout_user();
redirect(make_index_url());
}
elseif (!empty($_SESSION['pwg_uid']))