[ART]

I have some sensitive private data userfields in my user profiles.

I want to force a user to log in again to access at least his/her profile edit page (or force log out and show again log in form before accessing this page).

When somebody has the "remember me" option set it is very likely that he/she leaves an opened session in a public place and somebody can view this data, read his/hers PMs and so on.

How can I accomplish that on vb38x?

deleting user session in DB alone does not work - I have to reset user's cookies, too I believe. This snippet put into init_startup hook does not work:

PHP Code:

$logout_time = $vbulletin->input->clean_gpc('c', COOKIE_PREFIX . 'nextlogout', TYPE_UINT);

if (TIMENOW > $logout_time)
{

    // clear authentication cookies
    vbsetcookie('sessionhash', '');
    vbsetcookie('userid', '');
    vbsetcookie('password', '');

    // set next clear time
    vbsetcookie('nextlogout', TIMENOW + 900); // 900 = 15 min
} 


Maybe I'm missing something... any hints appreciated