Custom Logout Button

[doc55]

I want to create a custom logout button for my vB 5.3.3.
I'm using the following code from the core/vb/user.php file but it is not working. Can someone help me troubleshoot this code, please?
Thank you

PHP Code:

//init the vBulletin system
require_once( JPATH_SITE . '/forum/core/vb/vb.php' );
vB::init();

function processLogout() {
  global $vbulletin;

  $assertor = vB::getDbAssertor();
  $session = vB::getCurrentSession();
  $userinfo = $session->fetch_userinfo();
  $timeNow = vB::getRequest()->getTimeNow();
  $options = vB::getDatastore()->getValue( 'options' );

  if ( $userinfo[ 'userid' ]AND $userinfo[ 'userid' ] != -1 ) {
    // init user data manager
    $userdata = new vB_Datamanager_User( vB_DataManager_Constants::ERRTYPE_SILENT );
    $userdata->set_existing( $userinfo );
    $userdata->set( 'lastactivity', $timeNow - $options[ 'cookietimeout' ] );
    $userdata->set( 'lastvisit', $timeNow );
    $userdata->save();

    if ( !defined( 'VB_API' ) ) {
      $assertor->delete( 'session', array( 'userid' => $userinfo[ 'userid' ], 'apiaccesstoken' => null ) );
      $assertor->delete( 'cpsession', array( 'userid' => $userinfo[ 'userid' ] ) );
    }
  }

  $assertor->delete( 'session', array( 'sessionhash' => $session->get( 'dbsessionhash' ) ) );

  // Remove accesstoken from apiclient table so that a new one will be generated
  if ( defined( 'VB_API' )AND VB_API === true AND $vbulletin->apiclient[ 'apiclientid' ] ) {
    $assertor->update(
      'apiclient',
      array( 'apiaccesstoken' => '', 'userid' => 0 ),
      array( 'apiclientid' => intval( $vbulletin->apiclient[ 'apiclientid' ] ) )
    );
    $vbulletin->apiclient[ 'apiaccesstoken' ] = '';
  }

  if ( $vbulletin->session->created == true AND( !defined( 'VB_API' )OR!VB_API ) ) {
    // if we just created a session on this page, there's no reason not to use it
    $newsession = $vbulletin->session;
  } else {
    // API should always create a new session here to generate a new accesstoken
    $newsession = vB_Session::getNewSession( vB::getDbAssertor(), vB::getDatastore(), vB::getConfig(), '', 0, '', vB::getCurrentSession()->get( 'styleid' ) );
  }

  $newsession->set( 'userid', 0 );
  $newsession->set( 'loggedin', 0 );
  $vbulletin->session = & $newsession;

  $result = array();
  $result[ 'sessionhash' ] = $newsession->get( 'dbsessionhash' );
  $result[ 'apiaccesstoken' ] = $newsession->get( 'apiaccesstoken' );

  if ( defined( 'VB_API' )AND VB_API === true ) {
    if ( $_REQUEST[ 'api_c' ] ) {
      $assertor->update( 'apiclient',
        array(
          'apiaccesstoken' => $result[ 'apiaccesstoken' ],
          'userid' => 0,
        ),
        array(
          'apiclientid' => intval( $_REQUEST[ 'api_c' ] )
        )
      );
    }
  }

  vB::getHooks()->invoke( 'hookProcessLogout', array(
    'result' => & $result,
    'userinfo' => $userinfo,
  ) );

  return $result;
} 


[doc55]

What do you think about the following method to logout users?
Is it OK or does it cause any issues or security concerns?

PHP Code:

if (isset($_SERVER['HTTP_COOKIE'])) {
    $cookies = explode(';', $_SERVER['HTTP_COOKIE']);
    foreach($cookies as $cookie) {
        $parts = explode('=', $cookie);
        $name = trim($parts[0]);
        setcookie($name, '', time()-1000);
        setcookie($name, '', time()-1000, '/');
    }
} 


[Dave]

Use the official vBulletin API. /core/vb/api/user.php has a logout method.

I believe something like:

PHP Code:

$api = Api_InterfaceAbstract::instance();
$api->callApi('user', 'logout'); 


[doc55]

Thank you Dave for your helpful reply.
Here is the final and functioning code for others, if they need one:

PHP Code:

//Init the vBulletin system
require_once('/forum/includes/vb5/autoloader.php' );
vB5_Autoloader::register('/forum' );
vB5_Frontend_Application::init( 'config.php' );

//Get user info
$vb_userInfo = vB_Api::instance( 'user' )->fetchUserinfo();

//Log out URL
$logout_url = '/forum/auth/logout?logouthash=' . $vb_userInfo[ 'logouthash' ];
header( "Location: $logout_url" ); 


One question, with the above code, the user is logged out then redirected to the forum home. My forum is installed in mydomain.com/forum. How can I redirect users after logout to mydomain.com?

--------------- Added [DATE]1567529927[/DATE] at [TIME]1567529927[/TIME] ---------------

Maybe I should ask the question differently.
Is it possible to execute the as a function or in the background, instead of redirecting to it as a URL?

PHP Code:

$logout_url = '/forum/auth/logout?logouthash=' . $vb_userInfo[ 'logouthash' ]; 


[delicjous]

Did you try to call the API user logout?

PHP Code:

$logoutInfo = $api->callApi('user', 'logout', $logouthash); 


[doc55]

Originally Posted by delicjous

Did you try to call the API user logout?

PHP Code:

$logoutInfo = $api->callApi('user', 'logout', $logouthash); 


Thank you for your reply. I did try the API, but I can't make it work.
Here is my code when I use the API:

PHP Code:

//Init the vBulletin system
require_once( '/forum/includes/vb5/autoloader.php' );
vB5_Autoloader::register( '/forum' );
vB5_Frontend_Application::init( 'config.php' );
$api = Api_InterfaceAbstract::instance();

//Get user info
$vb_userInfo = vB_Api::instance( 'user' )->fetchUserinfo();
$logouthash = $vb_userInfo[ 'logouthash'];

//Logout
$logoutInfo = $api->callApi('user', 'logout', $logouthash); 

//Redirect
header( "Location: /index.php" ); 


With this, I get the following general error from vB:
That action could not be completed. Please try again, and if this occurs again please contact the system administrator and tell them how you got this message.

Maybe you could help me find what I'm doing wrong.
Thanks again.

[doc55]

Anyone could help with this script? I really appreciate anu help I can get.

[Dave]

I'm pretty sure you must put define('CSRF_PROTECTION', false); on top of the file.

[doc55]

Originally Posted by Dave

I'm pretty sure you must put define('CSRF_PROTECTION', false); on top of the file.

Thank you for your reply.
I tried adding this line on top:

PHP Code:

define( "CSRF_PROTECTION", false ); 


I also tried this line on top:

PHP Code:

require_once( '/forum/core/vb/vb.php' );
vB::init();
define( "CSRF_PROTECTION", false ); 


Both are giving me the same error message and the user is not logged out.

Here is the my final code so far:

PHP Code:

define( "CSRF_PROTECTION", false );
require_once( '/forum/includes/vb5/autoloader.php' );
vB5_Autoloader::register(  '/forum' );
vB5_Frontend_Application::init( 'config.php' );
$api = Api_InterfaceAbstract::instance();


//Get user info
$vb_userInfo = vB_Api::instance( 'user' )->fetchUserinfo();
$logouthash = $vb_userInfo[ 'logouthash'];

//Logout
$logoutInfo = $api->callApi('user', 'logout', $logouthash); 

//Redirect
header( "Location: /index.php" ); 


[Dave]

Works fine if I do

PHP Code:

$logoutInfo = vB_Api::instance('user')->logout($logouthash); 


instead.