58242 - relogin.cgi fails to delete server's copy of the cookie

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect, P3)

Description

[Brett]

I found it odd that relogin.cgi didn't clear out someone's entry(ies) from the
"logincookies" table after it logged them out, relying instead on
"confirm_login()" to clear them after they get 30 days old.  A table can fill up
fast that way.  I've solved this by adding these two lines to relogin.cgi just
after the line that says 'require "CGI.pl";':

ConnectToDatabase();
SendSQL("delete from logincookies where userid=" .
DBname_to_id(url_decode($::COOKIE{"Bugzilla_login"})));

(The url_decode is in there because I found I sometimes had "%40" instead of "@"
in the Bugzilla_login cookie and thus it wouldn't recognize the login...)

Just wanted to share :)

Comment 1

[Dave Miller [:justdave]]

moving to real milestones...

Comment 2

[Dave Miller [:justdave]]

I don't like the suggested patch here because it's possible to log in from more
than one browser at a time, and each one would get a different cookie.  Deleting
all of a user's cookies on the server side when they log out would effectively
log them off on every browser they had open (and every machine if they were
logged in on more than one machine at once - a lot of the developers do this).

However, I do agree that the cookie associated with that given session should be
deleted from the server when you log out.

Comment 3

[Dave Miller [:justdave]]

-> Bugzilla product

Comment 4

[Dave Miller [:justdave]]

We are currently trying to wrap up Bugzilla 2.16.  We are now close enough to
release time that anything that wasn't already ranked at P1 isn't going to make
the cut.  Thus this is being retargetted at 2.18.  If you strongly disagree with
this retargetting, please comment, however, be aware that we only have about 2
weeks left to review and test anything at this point, and we intend to devote
this time to the remaining bugs that were designated as release blockers.

Comment 5

[Dave Miller [:justdave]]

The patch on bug 95732 will fix this.

Comment 6

[Bradley Baetz (:bbaetz)]

Fixed as part of bug 95732