Custom Logout Button

[doc55]

I want to create a custom logout button for my vB 5.3.3.
I'm using the following code from the core/vb/user.php file but it is not working. Can someone help me troubleshoot this code, please?
Thank you

//init the vBulletin system
require_once( JPATH_SITE . '/forum/core/vb/vb.php' );
vB::init();

function processLogout() {
global $vbulletin;

$assertor = vB::getDbAssertor();
$session = vB::getCurrentSession();
$userinfo = $session->fetch_userinfo();
$timeNow = vB::getRequest()->getTimeNow();
$options = vB::getDatastore()->getValue( 'options' );

if ( $userinfo[ 'userid' ]AND $userinfo[ 'userid' ] != -1 ) {
// init user data manager
$userdata = new vB_Datamanager_User( vB_DataManager_Constants::ERRTYPE_SILENT );
$userdata->set_existing( $userinfo );
$userdata->set( 'lastactivity', $timeNow - $options[ 'cookietimeout' ] );
$userdata->set( 'lastvisit', $timeNow );
$userdata->save();

if ( !defined( 'VB_API' ) ) {
$assertor->delete( 'session', array( 'userid' => $userinfo[ 'userid' ], 'apiaccesstoken' => null ) );
$assertor->delete( 'cpsession', array( 'userid' => $userinfo[ 'userid' ] ) );
}
}

$assertor->delete( 'session', array( 'sessionhash' => $session->get( 'dbsessionhash' ) ) );

// Remove accesstoken from apiclient table so that a new one will be generated
if ( defined( 'VB_API' )AND VB_API === true AND $vbulletin->apiclient[ 'apiclientid' ] ) {
$assertor->update(
'apiclient',
array( 'apiaccesstoken' => '', 'userid' => 0 ),
array( 'apiclientid' => intval( $vbulletin->apiclient[ 'apiclientid' ] ) )
);
$vbulletin->apiclient[ 'apiaccesstoken' ] = '';
}

if ( $vbulletin->session->created == true AND( !defined( 'VB_API' )OR!VB_API ) ) {
// if we just created a session on this page, there's no reason not to use it
$newsession = $vbulletin->session;
} else {
// API should always create a new session here to generate a new accesstoken
$newsession = vB_Session::getNewSession( vB::getDbAssertor(), vB::getDatastore(), vB::getConfig(), '', 0, '', vB::getCurrentSession()->get( 'styleid' ) );
}

$newsession->set( 'userid', 0 );
$newsession->set( 'loggedin', 0 );
$vbulletin->session = & $newsession;

$result = array();
$result[ 'sessionhash' ] = $newsession->get( 'dbsessionhash' );
$result[ 'apiaccesstoken' ] = $newsession->get( 'apiaccesstoken' );

if ( defined( 'VB_API' )AND VB_API === true ) {
if ( $_REQUEST[ 'api_c' ] ) {
$assertor->update( 'apiclient',
array(
'apiaccesstoken' => $result[ 'apiaccesstoken' ],
'userid' => 0,
),
array(
'apiclientid' => intval( $_REQUEST[ 'api_c' ] )
)
);
}
}

vB::getHooks()->invoke( 'hookProcessLogout', array(
'result' => & $result,
'userinfo' => $userinfo,
) );

return $result;
}

[doc55]

What do you think about the following method to logout users?
Is it OK or does it cause any issues or security concerns?

if (isset($_SERVER['HTTP_COOKIE'])) {
$cookies = explode(';', $_SERVER['HTTP_COOKIE']);
foreach($cookies as $cookie) {
$parts = explode('=', $cookie);
$name = trim($parts[0]);
setcookie($name, '', time()-1000);
setcookie($name, '', time()-1000, '/');
}
}

[Dave]

Use the official vBulletin API. /core/vb/api/user.php has a logout method.

I believe something like:
$api = Api_InterfaceAbstract::instance();
$api->callApi('user', 'logout');

[doc55]

Thank you Dave for your helpful reply.
Here is the final and functioning code for others, if they need one:

//Init the vBulletin system
require_once('/forum/includes/vb5/autoloader.php' );
vB5_Autoloader::register('/forum' );
vB5_Frontend_Application::init( 'config.php' );

//Get user info
$vb_userInfo = vB_Api::instance( 'user' )->fetchUserinfo();

//Log out URL
$logout_url = '/forum/auth/logout?logouthash=' . $vb_userInfo[ 'logouthash' ];
header( "Location: $logout_url" );

One question, with the above code, the user is logged out then redirected to the forum home. My forum is installed in mydomain.com/forum. How can I redirect users after logout to mydomain.com?

--------------- Added 1567529927 at 1567529927 ---------------

Maybe I should ask the question differently.
Is it possible to execute the as a function or in the background, instead of redirecting to it as a URL?
$logout_url = '/forum/auth/logout?logouthash=' . $vb_userInfo[ 'logouthash' ];

[delicjous]

Did you try to call the API user logout?
$logoutInfo = $api->callApi('user', 'logout', $logouthash);

[doc55]

Did you try to call the API user logout?
$logoutInfo = $api->callApi('user', 'logout', $logouthash);

Thank you for your reply. I did try the API, but I can't make it work.
Here is my code when I use the API:
//Init the vBulletin system
require_once( '/forum/includes/vb5/autoloader.php' );
vB5_Autoloader::register( '/forum' );
vB5_Frontend_Application::init( 'config.php' );
$api = Api_InterfaceAbstract::instance();

//Get user info
$vb_userInfo = vB_Api::instance( 'user' )->fetchUserinfo();
$logouthash = $vb_userInfo[ 'logouthash'];

//Logout
$logoutInfo = $api->callApi('user', 'logout', $logouthash);

//Redirect
header( "Location: /index.php" );


With this, I get the following general error from vB:
That action could not be completed. Please try again, and if this occurs again please contact the system administrator and tell them how you got this message.

Maybe you could help me find what I'm doing wrong.
Thanks again.

[doc55]

Anyone could help with this script? I really appreciate anu help I can get.

[Dave]

I'm pretty sure you must put define('CSRF_PROTECTION', false); on top of the file.

[doc55]

I'm pretty sure you must put define('CSRF_PROTECTION', false); on top of the file.

Thank you for your reply.
I tried adding this line on top:

define( "CSRF_PROTECTION", false );

I also tried this line on top:
require_once( '/forum/core/vb/vb.php' );
vB::init();
define( "CSRF_PROTECTION", false );

Both are giving me the same error message and the user is not logged out.

Here is the my final code so far:

define( "CSRF_PROTECTION", false );
require_once( '/forum/includes/vb5/autoloader.php' );
vB5_Autoloader::register( '/forum' );
vB5_Frontend_Application::init( 'config.php' );
$api = Api_InterfaceAbstract::instance();


//Get user info
$vb_userInfo = vB_Api::instance( 'user' )->fetchUserinfo();
$logouthash = $vb_userInfo[ 'logouthash'];

//Logout
$logoutInfo = $api->callApi('user', 'logout', $logouthash);

//Redirect
header( "Location: /index.php" );

[Dave]

Works fine if I do
$logoutInfo = vB_Api::instance('user')->logout($logouthash);
instead.

[doc55]

Works fine if I do
$logoutInfo = vB_Api::instance('user')->logout($logouthash);
instead.

Thank you Dave. With that change, The script redirects to the index.php as it is expected and I'm not getting any error messages, but the user is not logged out.

[Dave]

I used the same script on my vBulletin 5 test forum and it logged me out properly. Maybe try clearing your cookies > login again > try the script.

[doc55]

Thank you for your reply.
I just tested it again after clearing the cookies, but still didn't log out the user.
Could this be because I have the option "Remember me" enabled on log-in?

I did var_dump($logoutInfo); and this is what I got:
array(2) { ["sessionhash"]=> string(32) "78370741ecec09885430016ec4c991fa" ["apiaccesstoken"]=> NULL }
I'm not sure if this would help.