For example: I'm already logged in to a Drupal install using "OpenID Sync Client". I have the OpenID "http://badguy.badddymc.bad". Cron runs and my OpenID is added to the banned list... but I stay logged in. Would it be possible to kill my session? Maybe killing all admin sessions with sess_destroy_uid($uid) is acceptable compromise?

CommentFileSizeAuthor
#1 force_logout.patch3.54 KBraines37

Comments

raines37’s picture

raines37 commented
Status: Active » Patch (to be ported)
StatusFileSize
new force_logout.patch3.54 KB

Attached is an SVN diff that adds this feature. I've tested this pretty extensively, but may have done some stupid stuff. Please check the "normalization" function especially for stupidity... Also, a minor change still needs to go in, which is noted in source.