tonyair
/
silverstripe-framework
mirror of https://github.com/silverstripe/silverstripe-framework
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

FIX Take current request protocol into account when deleting session cookie

This commit is contained in:
Florian Thoma 2021-08-06 10:55:05 +10:00
parent 507c70e2f5
commit 9a7c99fc4b
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/Control/Session.php
View File

@ -245,7 +245,7 @@ class Session
*/
public function restart(HTTPRequest $request)
{
$this->destroy();
$this->destroy(true, $request);
$this->start($request);
}
@ -358,14 +358,18 @@ class Session
* Destroy this session
*
* @param bool $removeCookie
* @param HTTPRequest $request The request for which to destroy a session
*/
public function destroy($removeCookie = true)
public function destroy($removeCookie = true, HTTPRequest $request = null)
{
if (session_id()) {
if ($removeCookie) {
if (!$request) {
$request = Controller::curr()->getRequest();
}
$path = $this->config()->get('cookie_path') ?: Director::baseURL();
$domain = $this->config()->get('cookie_domain');
$secure = $this->config()->get('cookie_secure');
$secure = Director::is_https($request) && $this->config()->get('cookie_secure');
Cookie::force_expiry(session_name(), $path, $domain, $secure, true);
}
session_destroy();

2
src/Security/MemberAuthenticator/SessionAuthenticationHandler.php
View File

@ -112,6 +112,6 @@ class SessionAuthenticationHandler implements AuthenticationHandler
public function logOut(HTTPRequest $request = null)
{
$request = $request ?: Controller::curr()->getRequest();
$request->getSession()->destroy();
$request->getSession()->destroy(true, $request);
}
}