mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
Thomas VincentandTheWitness
fa050a2417
* Revoke server-side auth tokens on logout clear_auth_cookie() ran after cacti_cookie_logout() had already unset $_COOKIE['cacti_remembers'], so its guard short-circuited and the user_auth_cache row was never deleted; the timeout/disabled/remote branch never called it at all. Move it ahead of the cookie clear so every logout revokes the remember-me token, and have logout-everywhere also terminate the user's other database sessions. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * Guard the logout test function-body offsets and reorder the changelog entry Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net>
83 lines
3.4 KiB
PHP
83 lines
3.4 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
| |
|
|
| This program is distributed in the hope that it will be useful, |
|
|
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
|
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
|
| GNU General Public License for more details. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
| This code is designed, written, and maintained by the Cacti Group. See |
|
|
| about.php and/or the AUTHORS file for specific developer information. |
|
|
+-------------------------------------------------------------------------+
|
|
| http://www.cacti.net/ |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
define('CACTI_IN_INSTALL', 1);
|
|
require('./include/auth.php');
|
|
|
|
// forcibly unlock cacti if the user logg's out
|
|
$admin_user = read_config_option('admin_user');
|
|
$lockout = read_config_option('cacti_lockout_status', true);
|
|
|
|
if ($lockout != '') {
|
|
$lockout = json_decode($lockout, true);
|
|
|
|
if ($admin_user == $_SESSION[SESS_USER_ID] && $lockout['session'] == session_id()) {
|
|
set_config_option('cacti_lockout_status', '');
|
|
}
|
|
}
|
|
|
|
set_default_action();
|
|
|
|
api_plugin_hook('logout_pre_session_destroy');
|
|
|
|
// Revoke the server-side remember-me token first: cacti_cookie_logout() unsets
|
|
// $_COOKIE['cacti_remembers'], and clear_auth_cookie() reads that cookie to find
|
|
// the row to delete. Running it afterwards (or only in the default branch below)
|
|
// left the user_auth_cache token valid after every logout.
|
|
clear_auth_cookie();
|
|
|
|
// Clear session
|
|
cacti_cookie_logout();
|
|
cacti_session_destroy();
|
|
|
|
$version = CACTI_VERSION;
|
|
|
|
api_plugin_hook('logout_post_session_destroy');
|
|
|
|
// allow for plugin based logout page
|
|
if (api_plugin_hook_function('custom_logout_message', OPER_MODE_NATIVE) === OPER_MODE_RESKIN) {
|
|
exit;
|
|
}
|
|
|
|
// Check to see if we are using Web Basic Auth
|
|
if (grv('action') == 'timeout' || grv('action') == 'disabled' || grv('action') == 'remote') {
|
|
$hook = 'logout';
|
|
$reason = __('a Session Timeout');
|
|
|
|
if (grv('action') == 'disabled') {
|
|
$hook = 'disabled';
|
|
$reason = __('an Account Suspension');
|
|
} elseif (grv('action') == 'remote') {
|
|
$hook = 'logout';
|
|
$reason = __('a change in state of the Remote Data Collector');
|
|
}
|
|
|
|
html_auth_header($hook, __('Logout of Cacti'), __('Automatic Logout'), __('You have been logged out of Cacti due to %s.', $reason));
|
|
print '<div>' . __('Please close your browser or %sLogin Again%s', '[<a href="index.php">', '</a>]') . '</div>';
|
|
html_auth_footer($hook, __('Cookies have been cleared'), '');
|
|
} else {
|
|
// Default action (the remember-me token was already revoked above)
|
|
header('Location: index.php');
|
|
}
|