View Issue Details

WikiJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0009665mantisbtauthenticationpublic2008-09-27 09:582009-01-15 11:25
Reporterjreese Assigned Tojreese  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
OSGentoo Linux 
Product Version1.2.0a2 
Target Version1.2.0a3Fixed in Version1.2.0a3 
Summary0009665: Logout without unsetting session cookie
Description

MantisSession#destory() uses session_destroy(). But it does not unset session cookie.
Logout should unset session cookie for security reason.
see attached patch.

Steps To Reproduce
  1. check session id.( with Firefox addon LiveHttpHeader)
  2. logout
  3. login
  4. check session id again.
Additional Information

1.1.2 and 1.2.0

TagsNo tags attached.

Relationships

related to 0009664 closedjreese Logout without unsetting session cookie 

Activities

jreese

jreese

2008-09-27 10:34

reporter   ~0019471

Fix has been committed to SVN trunk, r5593.