From f4831673b67f7ce7aab515ee02ee9b45ff2b2a0f Mon Sep 17 00:00:00 2001 From: Henning Bostelmann Date: Thu, 8 Sep 2011 11:51:28 +0100 Subject: [PATCH] MDL-26257 Shibboleth auth: run logout handler only if logged in via Shibboleth --- auth/shibboleth/auth.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/auth/shibboleth/auth.php b/auth/shibboleth/auth.php index fa0591e45a3..194e4b3aa1e 100644 --- a/auth/shibboleth/auth.php +++ b/auth/shibboleth/auth.php @@ -193,11 +193,11 @@ class auth_plugin_shibboleth extends auth_plugin_base { * */ function logoutpage_hook() { - global $redirect; + global $SESSION, $redirect; - // Only do this if logout handler is defined - if ( - isset($this->config->logout_handler) + // Only do this if logout handler is defined, and if the user is actually logged in via Shibboleth + if ( isset($SESSION->shibboleth_session_id) + && isset($this->config->logout_handler) && !empty($this->config->logout_handler) ){ // Check if there is an alternative logout return url defined