* Revoke server-side auth tokens on logout
clear_auth_cookie() ran after cacti_cookie_logout() had already unset
$_COOKIE['cacti_remembers'], so its guard short-circuited and the
user_auth_cache row was never deleted; the timeout/disabled/remote branch
never called it at all. Move it ahead of the cookie clear so every logout
revokes the remember-me token, and have logout-everywhere also terminate the
user's other database sessions.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Guard the logout test function-body offsets and reorder the changelog entry
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
