[#3113] Restore session deletion.

I over-committed in the previous commit and removed too much code. This restores session deletion if there is a session.id, but no valid session data.
ckan · Jun 14, 2016 · ad8db40 · ad8db40
1 parent 688a1a7
commit ad8db40
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/ckan/lib/base.py b/ckan/lib/base.py
@@ -309,9 +309,15 @@ def __call__(self, environ, start_response):
                         is_valid_cookie_data = True
                         break
                 if not is_valid_cookie_data:
-                    response.delete_cookie(cookie)
-                    self.log.debug('No session data any more - '
-                                   'deleting session cookie')
+                    if session.id:
+                        self.log.debug('No valid session data - '
+                                       'deleting session')
+                        self.log.debug('Session: %r', session.items())
+                        session.delete()
+                    else:
+                        self.log.debug('No session id - '
+                                       'deleting session cookie')
+                        response.delete_cookie(cookie)
             # Remove auth_tkt repoze.who cookie if user not logged in.
             elif cookie == 'auth_tkt' and not session.id:
                 response.delete_cookie(cookie)