From bba0ba2eb71a59040c5d0d623b3b7db375732151 Mon Sep 17 00:00:00 2001
From: jengo <jengo@alumni.egroupware.org>
Date: Fri, 28 Sep 2001 21:39:42 +0000
Subject: [PATCH] - Fixed destroy() not killing the correct session - Passing
 the sessionid and kp3 is now required, to make sure its the correct session -
 Removed deleting cookies, which is done by logout.php ... its redundent

---
 phpgwapi/inc/class.sessions.inc.php | 27 +++++++--------------------
 1 file changed, 7 insertions(+), 20 deletions(-)

diff --git a/phpgwapi/inc/class.sessions.inc.php b/phpgwapi/inc/class.sessions.inc.php
index bac2355af2..40a829f0bb 100644
--- a/phpgwapi/inc/class.sessions.inc.php
+++ b/phpgwapi/inc/class.sessions.inc.php
@@ -485,23 +485,14 @@
 			$GLOBALS['phpgw']->db->query("update phpgw_app_sessions set session_dla='" . time() . "' "
 								. "where sessionid='" . $this->sessionid."'",__LINE__,__FILE__);
 		}
-    
-		function destroy($sessionid='',$kp3='')
-		{
-			if(empty($sessionid) || !$sessionid)
-			{
-				$sessionid = $GLOBALS['HTTP_GET_VARS']['sessionid'] ? $GLOBALS['HTTP_GET_VARS']['sessionid'] : $GLOBALS['HTTP_COOKIE_VARS']['sessionid'];
-				$kp3       = $GLOBALS['HTTP_GET_VARS']['kp3']       ? $GLOBALS['HTTP_GET_VARS']['kp3']       : $GLOBALS['HTTP_COOKIE_VARS']['kp3'];
-			}
 
-			if(!$sessionid && $kp3)
+		function destroy($sessionid, $kp3)
+		{
+			if (! $sessionid && $kp3)
 			{
 				return False;
 			}
 
-			$GLOBALS['phpgw_info']['user']['sessionid'] = $sessionid;
-			$GLOBALS['phpgw_info']['user']['kp3'] = $kp3;
-	 
 			$GLOBALS['phpgw']->db->transaction_begin();
 			$GLOBALS['phpgw']->db->query("delete from phpgw_sessions where session_id='"
 								. $sessionid . "'",__LINE__,__FILE__);
@@ -509,16 +500,12 @@
 								. $sessionid . "'",__LINE__,__FILE__);
 			$GLOBALS['phpgw']->db->query("update phpgw_access_log set lo='" . time() . "' where sessionid='"
 								. $sessionid . "'",__LINE__,__FILE__);
-			if ($GLOBALS['phpgw_info']['server']['usecookies'])
+
+			// Only do the following, if where working with the current user
+			if ($sessionid == $GLOBALS['phpgw_info']['user']['sessionid'])
 			{
-				Setcookie('sessionid');
-				Setcookie('kp3');
-				if ($GLOBALS['phpgw_info']['multiable_domains'])
-				{
-					Setcookie('domain');
-				}
+				$this->clean_sessions();
 			}
-			$this->clean_sessions();
 			$GLOBALS['phpgw']->db->transaction_commit();
 
 			return True;