In head, user_logout calls sess_destroy($user->uid) which doesn't only end the current session but all other sessions that user has opened as well.
user_logout should simply call session_destroy() to end the current session. However, this doesn't work anymore because sess_destroy() no longer accepts a session id as parameter. It should, because it is registered as the session destroy handler.
The patch that changed this was http://drupal.org/node/77936 - the code to fix this is even there ;)
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | patch_158 | 2.47 KB | moshe weitzman |
| #6 | 20061203.session-logout-2.patch.txt | 3.25 KB | bart jansens |
| #5 | 20061203.session-logout.patch.txt | 2.95 KB | bart jansens |
| #3 | patch_147 | 2.03 KB | moshe weitzman |
| #2 | 20061112.session-logout.patch.txt | 2.37 KB | bart jansens |
Comments
Comment #1
bart jansens commentedLooks like filing a bug report and hoping someone else fixes it, doesn't work ;)
Patch attached.
Comment #2
bart jansens commentedforgot the patch
Comment #3
moshe weitzman commentedworks as advertised. i tested logout, block a user, and so on.
rerolled to remove fuzz.
Comment #4
dries commentedI'd prefer to make two functions: session_destroy_uid() and session_destroy_sid().
Comment #5
bart jansens commentedAllright, here is the patch with two functions.
Comment #6
bart jansens commentedForgot one call to sess_destroy in the previous patch.
Comment #7
moshe weitzman commentedtested. works as designed. rerolled since one hunk that had an unrelated comment change was failing.
i grepped contrib and only autologout and remember_me modules use sess_destroy(). i will personally submit a patch for autologout. remember_me has been superceded by persistent_login.module. i think we can say that this is not a significant API change.
Comment #8
dries commentedLooks good and works. Committed.
Comment #9
(not verified) commented