Bug 95732 - remove logincookies.cryptpassword, and invalidate cookies from

the db when required instead.
(Also fixes bug 58242 as a side effect)

r=myk, kiko

1 files changed, 13 insertions, 0 deletions

diff --git a/globals.pl b/globals.pl
index cc05ae345..845e6ed9a 100644
--- a/globals.pl
+++ b/globals.pl
@@ -706,6 +706,19 @@ sub InsertNewUser {
     return $password;
 }
 
+# Removes all entries from logincookies for $userid, except for the
+# optional $keep, which refers the logincookies.cookie primary key.
+# (This is useful so that a user changing their password stays logged in)
+sub InvalidateLogins {
+    my ($userid, $keep) = @_;
+
+    my $remove = "DELETE FROM logincookies WHERE userid = $userid";
+    if (defined $keep) {
+        $remove .= " AND cookie != " . SqlQuote($keep);
+    }
+    SendSQL($remove);
+}
+
 sub GenerateRandomPassword {
     my ($size) = @_;