From 9de798de718786ba40428682e36632346d38bb34 Mon Sep 17 00:00:00 2001
From: Martin Gauk <gauk@math.tu-berlin.de>
Date: Mon, 13 Mar 2017 12:49:14 +0000
Subject: [PATCH] MDL-58244 shibboleth: handle users who are logged out

If the user is (already) logged out, do not access $USER->auth and redirect him to the return URL.
---
 auth/shibboleth/logout.php | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/auth/shibboleth/logout.php b/auth/shibboleth/logout.php
index 997f757234a..7bb0bec6195 100644
--- a/auth/shibboleth/logout.php
+++ b/auth/shibboleth/logout.php
@@ -26,13 +26,14 @@ if (!is_enabled_auth('shibboleth')) {
 $inputstream = file_get_contents("php://input");
 if ($action == 'logout' && !empty($redirect)) {
 
-    if ($USER->auth == 'shibboleth') {
-        // Logout out user from application.
+    if (isloggedin($USER) && $USER->auth == 'shibboleth') {
+        // Logout user from application.
         require_logout();
-         // Finally, send user to the return URL.
-        redirect($redirect);
     }
 
+    // Finally, send user to the return URL.
+    redirect($redirect);
+
 } else if (!empty($inputstream)) {
 
     // Back channel logout.