Bug #6289

Online Docs miss documentation of Auth::logout()

Details

Submitted	2005-12-19 17:04 UTC
From	mb at computer-leipzig dot com
Assigned	aashley
Status	Closed
Package	Auth
PHP Version	Irrelevant
OS	Irrelevant
Roadmaps	(Not assigned)

Comments

[2005-12-19 17:04 UTC] mb at computer-leipzig dot com

Description:
------------
In http://pear.php.net/manual/en/package.authentication.auth.php there is no mention of the logout() member function of the Auth class, even though it is used in the introduction and even documented in the source.

[2006-04-28 09:03 UTC] pluton dot home at free dot fr

Yes I agree, no documentation are available for the loggout if you look at the end-user doumentation.
But if you llok at the API doumentation you can find some useful details.
http://pear.php.net/package/Auth/docs/latest/Auth/Auth.html
But I found that when a session expires (using the method setExpires()) it nevers run the logout method anyway (destructor ?). Meaning that I you try to reconnect with another login, you are still logged under the previous one. Maybe I should log this as a new bug ???

[2006-04-28 09:55 UTC] mb at computer-leipzig dot com

Found that later on as well. But still it is confusing to have two parallel docs.

Regarding setExpires() I didn't look at the source, but I would expect it to set the session.gc_maxlifetime php ini parameter. When that cookie expires, its data is simply deleted. That means any logout callback function that might have been registered with setLogoutCallback() can't be run. If this is the case, then is not documented there.

When the session expired, you are not logged in under the previous one and you don't automatically try to reconnet with another login. What happens is that the browser sends the session id of the expired session. Your php scripts will call session_start(). That will try to load the sessiond data. Since it is deleted, I don't know whether a new session id is generated or not. But in any case, your code should notice that the user is not logged in, since he doesn't have data in the session (eg. his user id). Then your scripts should forward the user to a "your session expired page" and offer to login again.

[2006-09-11 03:43 UTC] aashley at php dot net

This bug has been fixed in CVS.

If this was a documentation problem, the fix will appear on pear.php.net by the end of next Sunday (CET).

If this was a problem with the pear.php.net website, the change should be live shortly.

Otherwise, the fix will appear in the package's next release.

Thank you for the report and for helping us make PEAR better.