Logout globally - Beta

Well, what I'm trying to reach with this hack, is, that you can logout globally with it, no matter on how many browsers/computers you have your cookies saved.

This hack saves the time of creation of your user and password-cookies and if you logout, it updates the new lastlogout-field. If you try to login with a cookie, that has a creation time older than lastlogout, the cookie will be deleted. Thats it.

Pfew, I hope, you unterstood what I'm trying to tell you. :knockedout:

Now I need some people, that help me testing and sorting out bugs for that hack.

I haven't tested it on a live forum, yet, but maybe I do some testing, later today.

[Erwin]

Good idea.

To clarify this hack -

Normally, if you logout, you only log out for the computer you're on. If you go to the forums with another computer, you have to log out of that computer as well.

With this hack, when you logout, you automatically log out of every computer you have logged into the forum with.

I don't have a use for it, but it's a great idea. Especially if you logged in on a public computer and forgot to log out... and you can't get back to that computer to log out.

[Darth Cow]

Good idea, but your method isn't very secure - one can simply edit the time in the cookie. I think that encoding the time into the password part of the cookie (used for authentication) would be the most effective solution, but that would require storing each of the valid login times for each user in the database (you couldn't do a simple numerical comparison because the password/date would be MD5'd).

[Dean C]

Awesome...

I'll definately use this once a few people have confirmed it works

Regards

- miSt

[Stadler]

Originally posted by Darth Cow
Good idea, but your method isn't very secure - one can simply edit the time in the cookie. I think that encoding the time into the password part of the cookie (used for authentication) would be the most effective solution, but that would require storing each of the valid login times for each user in the database (you couldn't do a simple numerical comparison because the password/date would be MD5'd).

Well, you're right, but the encryption, that would be used, has to be two-way, because it needs to be checked, if the cookie is older or newer, than lastlogout.

[Stadler]

I've applied some changes and fixes, so please recheck the attachment.

Changes and fixes are as follows:

• I now use $ourtimenow instead of time()
• I've updated member.php?action=login, because I forgot to apply some changes there.
• As for Darth Cow's idea: I've added the md5-hash of $ourtimenow to the cookie "bbcookietime"

[Xenon]

The hack seems to be a very good idea, as erwin said, this can be very helpful if you forgot to logout on a public pc...

[Brad]

very good idea , im also releasing a global login point in the next few days.

[Julio]

1 - I think this is one of the most important hacks ever made.

2 - I installed the hack, but now I can't login with any username. Even admin, or any other account. Any idea?

- Lucky I always install hacks to one of my 2 local testboards! -

[ManagerJosh]

Definitely got my installation! Anyone from the vB3 dev team want to add this in?