tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

FIX Take current request protocol into account when deleting session cookie

Browse Source
This commit is contained in:
Florian Thoma 2021-08-06 10:55:05 +10:00
parent 507c70e2f5
commit 9a7c99fc4b
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/Control/Session.php
View File

@ -245,7 +245,7 @@ class Session
*/ */
public function restart(HTTPRequest $request) public function restart(HTTPRequest $request)
{ {
$this->destroy(); $this->destroy(true, $request);
$this->start($request); $this->start($request);
} }
@ -358,14 +358,18 @@ class Session
* Destroy this session * Destroy this session
* *
* @param bool $removeCookie * @param bool $removeCookie
* @param HTTPRequest $request The request for which to destroy a session
*/ */
public function destroy($removeCookie = true) public function destroy($removeCookie = true, HTTPRequest $request = null)
{ {
if (session_id()) { if (session_id()) {
if ($removeCookie) { if ($removeCookie) {
if (!$request) {
$request = Controller::curr()->getRequest();
}
$path = $this->config()->get('cookie_path') ?: Director::baseURL(); $path = $this->config()->get('cookie_path') ?: Director::baseURL();
$domain = $this->config()->get('cookie_domain'); $domain = $this->config()->get('cookie_domain');
$secure = $this->config()->get('cookie_secure'); $secure = Director::is_https($request) && $this->config()->get('cookie_secure');
Cookie::force_expiry(session_name(), $path, $domain, $secure, true); Cookie::force_expiry(session_name(), $path, $domain, $secure, true);
} }
session_destroy(); session_destroy();

2
src/Security/MemberAuthenticator/SessionAuthenticationHandler.php
View File

@ -112,6 +112,6 @@ class SessionAuthenticationHandler implements AuthenticationHandler
public function logOut(HTTPRequest $request = null) public function logOut(HTTPRequest $request = null)
{ {
$request = $request ?: Controller::curr()->getRequest(); $request = $request ?: Controller::curr()->getRequest();
$request->getSession()->destroy(); $request->getSession()->destroy(true, $request);
} }
} }