Bug 95732 - remove logincookies.cryptpassword, and invalidate cookies from

the db when required instead.
(Also fixes bug 58242 as a side effect)

r=myk, kiko

1 files changed, 6 insertions, 2 deletions

diff --git a/editusers.cgi b/editusers.cgi
index a2a6ee51b..ad00dd9ae 100755
--- a/editusers.cgi
+++ b/editusers.cgi
@@ -808,6 +808,11 @@ if ($action eq 'update') {
             SendSQL("UPDATE  profiles
                      SET     cryptpassword = $cryptpassword
                      WHERE   login_name = $loginname");
+            SendSQL("SELECT userid
+                     FROM profiles
+                     WHERE login_name=" . SqlQuote($userold));
+            my $userid = FetchOneColumn();
+            InvalidateLogins($userid);
             print "Updated password.<BR>\n";
         } else {
             print "Did not update password: $passworderror<br>\n";
@@ -827,8 +832,7 @@ if ($action eq 'update') {
                  FROM profiles
                  WHERE login_name=" . SqlQuote($userold));
         my $userid = FetchOneColumn();
-        SendSQL("DELETE FROM logincookies
-                 WHERE userid=" . $userid);
+        InvalidateLogins($userid);
         print "Updated disabled text.<BR>\n";
     }
     if ($editall && $user ne $userold) {