2

I am learning the basic concept of how to manage login process and sessions. I take it that to logout a user, you need to destroy the session created for him. I was trying to find out how joomla 3.4 handles "logout" action to verify whether I have correctly understand what I have learned. But I have trouble finding out which PHP file is actually taking care of the "logout" logic. Here is what I do:

Firstly, I think no matter what fancy(to me) library or framework Joomla is using, down to bottom, there should be a file receiving "$_POST" datas, so I searched $_POST among all PHP files in my site, and I found this file "libraries/legacy/request/request.php" with this function

Class JRequest{
    .....
    public static function getVar($name, $default = null, $hash = 'default', $type = 'none', $mask = 0)
    {
        // Ensure hash and type are uppercase
        $hash = strtoupper($hash);

        if ($hash === 'METHOD')
        {
            $hash = strtoupper($_SERVER['REQUEST_METHOD']);
        }

        $type = strtoupper($type);
        $sig = $hash . $type . $mask;

        // Get the input hash
        switch ($hash)
        {
            case 'GET':
                $input = &$_GET;
                break;
            case 'POST':
                $input = &$_POST;
                break;
            case 'FILES':
                $input = &$_FILES;
                break;
            case 'COOKIE':
                $input = &$_COOKIE;
                break;
            case 'ENV':
                $input = &$_ENV;
                break;
            case 'SERVER':
                $input = &$_SERVER;
                break;
            default:
                $input = &$_REQUEST;
                $hash = 'REQUEST';
                break;
        }
.....

It seems to me Joomla has integrated "$_POST" data processing into this function so whenever Joomla wants to deal with user input, it will call this function. So I continue to search JRequest::getVar among all PHP files, I found only 1 occurence, which is in components/com_meida/views/medialist/view.html.php line 64

$dirname = JRequest::getVar('folder', '', '', 'string');

This doesn't look like having anything to do with login/logout processing. So I widen my search to just getVar, although there are many occurences, none of them looks like relevant and this is where I got stuck.

Could you please not only point out the PHP file I am looking for but also tell me what is wrong with my approach? Thank you in advance.

Improve this question

1 Answer 1

Reset to default
3

JRequest::getVar is an old deprecated method to get global variables which is no longer used in Joomla 3.x

Session:

Joomla has it's own framework which can be found here:

libaries/joomla/

The file you're specifically looking for that deals with destroying the session is:

libraries/joomla/session/session.php line 682

See on Github here: https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/session/session.php#L682

As you can see, this calls $this->_handler->clear();, and the function for this is here: https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/session/handler/native.php#L243

This unsets and destroys the session

Logout:

If you want to go further back before the session is dealt with, have a look at:

administrator/components/com_login/controller.php line 97

Improve this answer
1
  • TYVM.I still want to know when users click "logout", what kind of global variable was sent and sent to where. I was trying to backtrace from that destroy() function in session.php. But it was very hard for me to debug this file: First I changed the name of the function, then when I click 'logout' I got an error, so its confirmed that this function was called when logging out. Then I insert echo 's'; into the destroy() as well as var_dump(debug_backtrace()), but none of them got any result to display on front end. I even try using j!dump to backtrace, but still got nothing.How debug it?
    – shenkwen
    Jan 29, 2016 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.