From 19e6e8ca6d00dfd2e47dcadb891c1f0672cf95c4 Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <dany@alchimerys.be>
Date: Tue, 15 Sep 2015 11:49:41 +0200
Subject: [PATCH] Security : clean cookie and global variables when logging out

---
 html/logout.php | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/html/logout.php b/html/logout.php
index 64db90d53..0b65167d6 100644
--- a/html/logout.php
+++ b/html/logout.php
@@ -27,6 +27,22 @@ require_once('lib/class_database.php');
 html_page_start("classic");
 
 session_unset();
+/* clean Global variable */
+
+if ( isset ($g_user) ) unset ($GLOBAL['g_user']);
+if ( isset ($g_pass) ) unset ($GLOBAL['g_pass']);
+//
+// Clean the possible cookies
+//
+if (isset($_SERVER['HTTP_COOKIE'])) {
+    $cookies = explode(';', $_SERVER['HTTP_COOKIE']);
+    foreach($cookies as $cookie) {
+        $parts = explode('=', $cookie);
+        $name = trim($parts[0]);
+        setcookie($name, '', time()-1000);
+        setcookie($name, '', time()-1000, '/');
+    }
+}
 echo '<h2 class="info">'._('Vous êtes déconnecté').'</h2>';
 echo '<META HTTP-EQUIV="REFRESH" content="0;url=index.html">';