Website Membership - Logoff

Hi,

You're right, the logoff functions do completely erase the $_SESSION array. There are a couple of function calls within the plugin that will trigger this:
- user_logoff()
- user_eraseLoginSession()

What you can do is customize your plugin code to not use these functions. Instead you can set the $CURRENT_USER array to false and empty the username and passwordHash $_SESSION elements your self.

For example:

// remove login cookies
function _websiteLogin_logoff() {
global $CURRNET_USER;

// get logoff url
if ($GLOBALS['WEBSITE_LOGIN_POST_LOGOFF_URL']) {
$logoffUrl = $GLOBALS['WEBSITE_LOGIN_POST_LOGOFF_URL'];
}
else {
$logoffUrl = thisPageUrl();
$logoffUrl = preg_replace('/\baction=logoff\b/', '', $logoffUrl); // prevent redirect loop
}

// logoff and redirect
//user_logoff($logoffUrl);

$CURRNET_USER = false;
$_SESSION['username'] = "";
$_SESSION['passwordHash'] = "";
redirectBrowserToURL($logoffUrl);
exit;
}

There are some important things to note here:
1) In every function that you do this in, you need the code global $CURRENT_USER; at the top in order to be able to access the $CURRENT_USER variable.
2)This customization is untested and may cause other problems. It might be a good idea to see if you can customize your other code to not use the $_SESSION array.

Hope this helps.

Hi Paul,

The reason we're destroying the entire $_SESSION array is to be as secure as possible. You are right, however, as it does cause problems if you are storing other pieces of information in the $_SESSION array. This is something we can look at changing for a future release.

Thanks