only destroy unlogged sessions

diff --git a/include/functions.php b/include/functions.php
index 05f184eafe80d294e122be82d4754286a4ff781e..f4f6ed2095c1d83a65d8ac52c01869f491f4b52d 100644 (file)
--- a/include/functions.php
+++ b/include/functions.php
@@ -744,7 +744,9 @@
                        cache_prefs($link);
                        load_user_plugins($link, $_SESSION["uid"]);
                } else {
-                       if (!$_SESSION["uid"] || !validate_session($link)) {
+                       if (!validate_session($link)) $_SESSION["uid"] = false;
+
+                       if (!$_SESSION["uid"]) {
 
                                if (AUTH_AUTO_LOGIN && authenticate_user($link, null, null)) {
                                    $_SESSION["ref_schema_version"] = get_schema_version($link, true);
@@ -752,12 +754,12 @@
                                         authenticate_user($link, null, null, true);
                                }
 
-                               if (!$_SESSION["uid"]) render_login_form($link);
-
-                               @session_destroy();
-                               setcookie(session_name(), '', time()-42000, '/');
-
-                               exit;
+                               if (!$_SESSION["uid"]) {
+                                       render_login_form($link);
+                                       @session_destroy();
+                                       setcookie(session_name(), '', time()-42000, '/');
+                                       exit;
+                               }
 
                        } else {
                                /* bump login timestamp */