Problems with logging out users

Question

I was running through some tests on my site with a client, and I was logged in as a normal authenticated user. I then logged out with the intention of logging back in as the superadmin (uid -> 1).

I navigated to a node page where there was a login form, and the site automatically logged me in as the authenticated user that I was logged in as previously.

Do you have any ideas of what could be causing this? The page that where this auto-login occurred reads off of a custom node.tpl file and I've got a few user_load() calls in that code.

Answer 1

If you are also using the global $user object in your code, doing something like $user=user_load($node->uid) can 'log you in'. This is a security issue and should be corrected.

Answer 2

It sounds like you have a global $user object that you are then overwriting.

The problem code would look something like:

global $user;
$user = user_load($new_user_id);

Search though all of your code for any occurrences of user_load() to locate the problem line.

For safety I usually use copy the global $user to an $account object so I can be user nothing will change the global $user.

For example:

global $user;
$account = $user;

// Do stuff with $account safe in the knowledge that even if I 
// accidentally change it it won't effect the global $user object

Answer 3

I would advise to check caching settings. If you have multiple user_load() calls in page.tpl, and still get previous version of the page, that's a sign of page.tpl not being called at all. So, first of all, check that you don't have aggressive caching/wrong boost settings

Answer 4

Are you using some browser plugin to store login information like Lastpass? Maybe it automatically sign you in everytime you are trying to access the login page. Did you clear your browser cookies? I was in the same problem before but I found out that my plugin(Lastpass) was the root cause of my problem. Try to browse in incognito or use other browser.

Answer 5

Something like this has happened to me before. There was a case of checking whether the current user is the admin. Instead of checking of equality

if($user->uid==1){ 
    // put code here
}

I did assignement

if($user->uid==1){ 
    // put code here
}