From ebc3c2e2f7d9408db7e5335d63fdd2a003c3d79a Mon Sep 17 00:00:00 2001 From: rvelices Date: Thu, 16 Oct 2008 00:38:26 +0000 Subject: merge 2755 and 2756 from branch 2.0 to trunk - 2755 fix vulnerability http://www.milw0rm.com/exploits/6755 - 2756 security paranoia: protect session/remember me cookies from XSS attacks (works only if php>=5.2 and with IE/FF maybe others) git-svn-id: http://piwigo.org/svn/trunk@2757 68402e56-0260-453c-a942-63ccdbb3a9ee --- include/user.inc.php | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) (limited to 'include/user.inc.php') diff --git a/include/user.inc.php b/include/user.inc.php index 9d7d2f242..0084a3aff 100644 --- a/include/user.inc.php +++ b/include/user.inc.php @@ -29,14 +29,7 @@ if (isset($_COOKIE[session_name()])) session_start(); if (isset($_GET['act']) and $_GET['act'] == 'logout') { // logout - $_SESSION = array(); - session_unset(); - session_destroy(); - setcookie(session_name(),'',0, - ini_get('session.cookie_path'), - ini_get('session.cookie_domain') - ); - setcookie($conf['remember_me_name'], '', 0, cookie_path()); + logout_user(); redirect(make_index_url()); } elseif (!empty($_SESSION['pwg_uid'])) -- cgit v1.2.3