Don't show cached logged-in pages to logged-out users (bug 63)

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index a9ce24f..2903e0d 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -112,7 +112,7 @@ class OutputPage {
                        $ismodsince = wfTimestamp( TS_MW, strtotime( $modsince ) );
                        wfDebug( "-- client send If-Modified-Since: " . $modsince . "\n", false );
                        wfDebug( "--  we might send Last-Modified : $lastmod\n", false );
-                       if( ($ismodsince >= $timestamp ) and $wgUser->validateCache( $ismodsince ) ) {
+                       if( ($ismodsince >= $timestamp ) && $wgUser->validateCache( $ismodsince ) && !$wgUser->wasLoggedInAt( $ismodsince )) {
                                # Make sure you're in a place you can leave when you call us!
                                header( "HTTP/1.0 304 Not Modified" );
                                $this->mLastModified = $lastmod;

diff --git a/includes/User.php b/includes/User.php
index ffd7e0c..c347f30 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -899,6 +899,10 @@ class User {
                } else {
                        setcookie( $wgDBname.'Token', '', time() - 3600 );
                }
+
+               # Clear previous logged out time, set logged in time
+               setcookie( $wgDBname.'LoggedOut', '', time() - 3600, $wgCookiePath, $wgCookieDomain );
+               setcookie( $wgDBname.'LoggedIn', wfTimestampNow(), time() + 86400, $wgCookiePath, $wgCookieDomain );
        }
 
        /**
@@ -914,6 +918,9 @@ class User {
 
                setcookie( $wgDBname.'UserID', '', time() - 3600, $wgCookiePath, $wgCookieDomain );
                setcookie( $wgDBname.'Token', '', time() - 3600, $wgCookiePath, $wgCookieDomain );
+
+               # Remember when user logged out, to prevent seeing cached pages
+               setcookie( $wgDBname.'LoggedOut', wfTimestampNow(), time() + 86400, $wgCookiePath, $wgCookieDomain );
        }
 
        /**
@@ -1177,6 +1184,20 @@ class User {
                }
                return false;
        }
+
+       /**
+        * Check if the user was logged on at a certain timestamp, but no longer is.
+        * @param int $timestamp Timestamp to check.
+        * @return bool True if user was logged in.
+        */
+       function wasLoggedInAt( $timestamp ) {
+               global $wgDBname;
+
+               if ( !$this->getID() && isset( $_COOKIE[$wgDBname.'LoggedIn'] ) && isset( $_COOKIE[$wgDBname.'LoggedOut'] ) )
+                       return ( $timestamp >= $_COOKIE[$wgDBname.'LoggedIn'] && $timestamp <= $_COOKIE[$wgDBname.'LoggedOut'] );
+               else
+                       return false;
+       }
 }
 
 ?>