[RFC|Merged] Ability to delete auto login keys

[Elglobo]

A user interface / ucp module has to be written.

Where do you see exactly this module ? In UCP -> Profile or a new tab dedicated ?

[Danielx64]

UCP > Profile > Edit account settings or under a new tab in UCP > Profile and call it forum sessions or something like that.

[nickvergessen]

call it forum sessions or something like that.

Better would be auto login keys?

[A_Jelly_Doughnut]

Could integrate this functionality into the "delete coolies set by this forum" feature. The two concepts are closely related.

[Ger]

Could integrate this functionality into the "delete coolies set by this forum" feature. The two concepts are closely related.

This seems the most sensible and easy way to do this. When someone is bothered with logins, they probably use this feature. In the confirm text some more explanation should be provided, something like:

Are you sure you want to delete all cookies set by this board? This will also remove any stored login sessions for your account on other computers.

The link should be renamed to

Delete cookies and sessions set by this forum

When confirmed, the tables phpbb_sessions and phpbb_sessions_keys should be searched for the current user_id and delete those.

This should be easy to implement and is very easily understood by the end user (I don't think the avarage joe would look for something like this in the UCP).

[Ger]

I'm not yet familiar with GIT, but here's my solution for this (based on the system described in my previous post):

OPEN
./ucp.php

FIND

Code: Select all

	case 'delete_cookies':

		// Delete Cookies with dynamic names (do NOT delete poll cookies)
		if (confirm_box(true))
		{
			$set_time = time() - 31536000;

			foreach ($_COOKIE as $cookie_name => $cookie_data)
			{
				// Only delete board cookies, no other ones...
				if (strpos($cookie_name, $config['cookie_name'] . '_') !== 0)
				{
					continue;
				}

				$cookie_name = str_replace($config['cookie_name'] . '_', '', $cookie_name);

				// Polls are stored as {cookie_name}_poll_{topic_id}, cookie_name_ got removed, therefore checking for poll_
				if (strpos($cookie_name, 'poll_') !== 0)
				{
					$user->set_cookie($cookie_name, '', $set_time);
				}
			}

			$user->set_cookie('track', '', $set_time);
			$user->set_cookie('u', '', $set_time);
			$user->set_cookie('k', '', $set_time);
			$user->set_cookie('sid', '', $set_time);

			// We destroy the session here, the user will be logged out nevertheless
			$user->session_kill();
			$user->session_begin();

			meta_refresh(3, append_sid("{$phpbb_root_path}index.$phpEx"));

			$message = $user->lang['COOKIES_DELETED'] . '<br /><br />' . sprintf($user->lang['RETURN_INDEX'], '<a href="' . append_sid("{$phpbb_root_path}index.$phpEx") . '">', '</a>');
			trigger_error($message);
		}
		else
		{
			confirm_box(false, 'DELETE_COOKIES', '');
		}

		redirect(append_sid("{$phpbb_root_path}index.$phpEx"));

	break;

REPLACE WITH

Code: Select all

	case 'delete_cookies_sessions':

		if (confirm_box(true))
		{
			// Delete Cookies with dynamic names (do NOT delete poll cookies)
			$set_time = time() - 31536000;

			foreach ($_COOKIE as $cookie_name => $cookie_data)
			{
				// Only delete board cookies, no other ones...
				if (strpos($cookie_name, $config['cookie_name'] . '_') !== 0)
				{
					continue;
				}

				$cookie_name = str_replace($config['cookie_name'] . '_', '', $cookie_name);

				// Polls are stored as {cookie_name}_poll_{topic_id}, cookie_name_ got removed, therefore checking for poll_
				if (strpos($cookie_name, 'poll_') !== 0)
				{
					$user->set_cookie($cookie_name, '', $set_time);
				}
			}

			$user->set_cookie('track', '', $set_time);
			$user->set_cookie('u', '', $set_time);
			$user->set_cookie('k', '', $set_time);
			$user->set_cookie('sid', '', $set_time);

			// We destroy the session here, the user will be logged out nevertheless
			$user->session_kill();
			$user->session_begin();

			// Delete all sessions by this user in de sessions tables
			$sql = 'DELETE FROM ' . SESSIONS_TABLE . "
				WHERE session_user_id = " . $user->data['user_id'];
			$db->sql_query($sql);
			$sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . "
				WHERE user_id = ". $user->data['user_id'];
			$db->sql_query($sql);

			meta_refresh(3, append_sid("{$phpbb_root_path}index.$phpEx"));

			$message = $user->lang['COOKIES_SESSIONS_DELETED'] . '<br /><br />' . sprintf($user->lang['RETURN_INDEX'], '<a href="' . append_sid("{$phpbb_root_path}index.$phpEx") . '">', '</a>');
			trigger_error($message);
		}
		else
		{
			confirm_box(false, 'DELETE_COOKIES_SESSIONS', '');
		}

		redirect(append_sid("{$phpbb_root_path}index.$phpEx"));

	break;

OPEN
./includes/functions.php
FIND

Code: Select all

		'U_DELETE_COOKIES'		=> append_sid("{$phpbb_root_path}ucp.$phpEx", 'mode=delete_cookies'),

REPLACE WITH

Code: Select all

		'U_DELETE_COOKIES_SESSIONS'		=> append_sid("{$phpbb_root_path}ucp.$phpEx", 'mode=delete_cookies_sessions'),

OPEN
./language/en/common.php
FIND

Code: Select all

	'COOKIES_DELETED'		=> 'All board cookies successfully deleted.',

REPLACE WITH

Code: Select all

	'COOKIES_SESSIONS_DELETED'		=> 'All board cookies and login sessions are successfully deleted.',

FIND

Code: Select all

	'DELETE_COOKIES'		=> 'Delete all board cookies',

REPLACE WITH

Code: Select all

	'DELETE_COOKIES_SESSIONS'		=> 'Delete all board cookies and sessions',

OPEN
./language/en/ucp.php
FIND

Code: Select all

	'DELETE_COOKIES_CONFIRM'	=> 'Are you sure you want to delete all cookies set by this board?',

REPLACE WITH

Code: Select all

	'DELETE_COOKIES_SESSIONS_CONFIRM'	=> 'Are you sure you want to delete all cookies and login sessions set by this board? This wil also delete login sessions of this board stored by other systems. You will also get logged out.',

OPEN
./styles/prosilver/template/overall_footer.html
FIND

Code: Select all

<!-- IF not S_IS_BOT --><a href="{U_DELETE_COOKIES}">{L_DELETE_COOKIES}</a> &bull; <!-- ENDIF -->

REPLACE WITH

Code: Select all

<!-- IF not S_IS_BOT --><a href="{U_DELETE_COOKIES_SESSIONS}">{L_DELETE_COOKIES_SESSIONS}</a> &bull; <!-- ENDIF -->

OPEN
./styles/subsilver2/template/index_body.html
FIND

Code: Select all

<!-- IF not S_IS_BOT --><a href="{U_DELETE_COOKIES}">{L_DELETE_COOKIES}</a><!-- ENDIF -->

REPLACE WITH

Code: Select all

<!-- IF not S_IS_BOT --><a href="{U_DELETE_COOKIES_SESSIONS}">{L_DELETE_COOKIES_SESSIONS}</a><!-- ENDIF -->

EoM

[dhruv.goel92]

I have made a PR. If some could take a look and suggest improvements if any.
One improvement i thought of adding was to highlight the current sessions key.

https://github.com/phpbb/phpbb3/pull/652

[naderman]

This has been merged today. There is still a plan to rename the feature of remembering login info everywhere to "Remember Me": http://tracker.phpbb.com/browse/PHPBB3-10771 - but that is not part of this RFC anymore.