From cc9334562a5923ef423a9d15a319b5ad99522913 Mon Sep 17 00:00:00 2001
From: int2str <int2str@users.sourceforge.net>
Date: Wed, 26 May 2004 00:59:27 +0000
Subject: [PATCH] Fixed HTTP authentication logout function. Logout is still
 pretty clumsy, but such is the nature of http auth...

git-svn-id: http://mantisbt.svn.sourceforge.net/svnroot/mantisbt/trunk@2570 f5dc347c-c33d-0410-90a0-b07cc1902cb9
---
 config_defaults_inc.php     |  5 +++--
 core/authentication_api.php | 21 ++++++++++++++++-----
 login.php                   | 16 +++++++++++-----
 logout_page.php             |  4 ++--
 4 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/config_defaults_inc.php b/config_defaults_inc.php
index 80f67d8de2..783173b543 100644
--- a/config_defaults_inc.php
+++ b/config_defaults_inc.php
@@ -6,7 +6,7 @@
 	# See the README and LICENSE files for details
 
 	# --------------------------------------------------------
-	# $Id: config_defaults_inc.php,v 1.166 2004-05-24 13:50:47 vboctor Exp $
+	# $Id: config_defaults_inc.php,v 1.167 2004-05-26 00:59:27 int2str Exp $
 	# --------------------------------------------------------
 
 
@@ -904,6 +904,7 @@
 	$g_project_cookie		= $g_cookie_prefix.'_PROJECT_COOKIE';
 	$g_view_all_cookie		= $g_cookie_prefix.'_VIEW_ALL_COOKIE';
 	$g_manage_cookie		= $g_cookie_prefix.'_MANAGE_COOKIE';
+	$g_logout_cookie		= $g_cookie_prefix.'_LOGOUT_COOKIE';
 
 	#######################################
 	# Mantis Filter Variables
@@ -1151,4 +1152,4 @@
 		UNREAD       => 'unread.gif'
 	);
 	# --------------------
-?>
\ No newline at end of file
+?>
diff --git a/core/authentication_api.php b/core/authentication_api.php
index 4459c92521..72c642e470 100644
--- a/core/authentication_api.php
+++ b/core/authentication_api.php
@@ -6,7 +6,7 @@
 	# See the README and LICENSE files for details
 
 	# --------------------------------------------------------
-	# $Id: authentication_api.php,v 1.38 2004-05-25 23:43:48 int2str Exp $
+	# $Id: authentication_api.php,v 1.39 2004-05-26 00:59:27 int2str Exp $
 	# --------------------------------------------------------
 
 	### Authentication API ###
@@ -372,10 +372,21 @@ function auth_http_prompt() {
 		exit;
 	}
 
-	function auth_http_logout() {
-		$_SERVER['PHP_AUTH_USER'] = "";
-		$_SERVER['PHP_AUTH_PW'] = "";
+	function auth_http_set_logout_pending( $p_pending ) {
+		$t_cookie_name = config_get( 'logout_cookie' );
 
-		auth_http_prompt();
+		if ( $p_pending ) {
+			gpc_set_cookie( $t_cookie_name, "1", false );
+		} else {
+			$t_cookie_path = config_get( 'cookie_path' );
+			gpc_clear_cookie( $t_cookie_name, $t_cookie_path );
+		}
+	}
+
+	function auth_http_is_logout_pending() {
+		$t_cookie_name = config_get( 'logout_cookie' );
+		$t_cookie = gpc_get_cookie( $t_cookie_name, '' );
+
+		return( $t_cookie > '' );
 	}
 ?>
diff --git a/login.php b/login.php
index d6220aa17b..4363149d63 100644
--- a/login.php
+++ b/login.php
@@ -6,7 +6,7 @@
 	# See the README and LICENSE files for details
 
 	# --------------------------------------------------------
-	# $Id: login.php,v 1.30 2004-05-25 23:43:48 int2str Exp $
+	# $Id: login.php,v 1.31 2004-05-26 00:59:27 int2str Exp $
 	# --------------------------------------------------------
 ?>
 <?php
@@ -19,6 +19,7 @@
 	$f_password		= gpc_get_string( 'password', '' );
 	$f_perm_login	= gpc_get_bool( 'perm_login' );
 	$f_return		= gpc_get_string( 'return', 'main_page.php' );
+	$f_from			= gpc_get_string( 'from', '' );
 
 	if ( BASIC_AUTH == config_get( 'login_method' ) ) {
 		$f_username = $_SERVER['REMOTE_USER'];
@@ -26,10 +27,15 @@
  	}
 
     if ( HTTP_AUTH == config_get( 'login_method' ) ) {
-		if ( isset( $_SERVER['PHP_AUTH_USER'] ) )
-			$f_username = $_SERVER['PHP_AUTH_USER'];
-		if ( isset( $_SERVER['PHP_AUTH_PW'] ) )
-			$f_password = $_SERVER['PHP_AUTH_PW'];
+		if ( !auth_http_is_logout_pending() )
+		{
+			if ( isset( $_SERVER['PHP_AUTH_USER'] ) )
+				$f_username = $_SERVER['PHP_AUTH_USER'];
+			if ( isset( $_SERVER['PHP_AUTH_PW'] ) )
+				$f_password = $_SERVER['PHP_AUTH_PW'];
+		} else {
+			auth_http_set_logout_pending( false );
+		}
 	}
 
 	if ( auth_attempt_login( $f_username, $f_password, $f_perm_login ) ) {
diff --git a/logout_page.php b/logout_page.php
index c579c1bf4d..481437ced5 100644
--- a/logout_page.php
+++ b/logout_page.php
@@ -6,7 +6,7 @@
 	# See the README and LICENSE files for details
 
 	# --------------------------------------------------------
-	# $Id: logout_page.php,v 1.15 2004-05-25 23:43:48 int2str Exp $
+	# $Id: logout_page.php,v 1.16 2004-05-26 00:59:27 int2str Exp $
 	# --------------------------------------------------------
 ?>
 <?php
@@ -18,7 +18,7 @@
 	auth_logout();
 
 	if ( HTTP_AUTH == config_get( 'login_method' ) ) {
-		auth_http_logout();
+		auth_http_set_logout_pending( true );
 	}
 
 	print_header_redirect( config_get( 'logout_redirect_page' ) );