@@ -, +, @@ C4::Auth::checkauth() --- C4/Auth.pm | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -734,7 +734,7 @@ sub checkauth { } elsif ( !$lasttime || ($lasttime < time() - $timeout) ) { # timed logout - $info{'timed_out'} = 1; + $info{'timed_out'} = 1 if $lasttime; if ($session) { $session->delete(); $session->flush; @@ -992,12 +992,20 @@ sub checkauth { } else { + ## if we got here, it is an unsuccessfull login attempt if ($userid) { $info{'invalid_username_or_password'} = 1; - C4::Context->_unset_userenv($sessionID); } - $session->param('lasttime',time()); - $session->param('ip',$session->remote_addr()); + if ($session) { + $session->delete(); + $session->flush; + } + C4::Context->_unset_userenv($sessionID) if $sessionID; + $userid = undef; + $sessionID = undef; + ## probably not a good idea (at least not without setting up 'sessiontype' to 'anon' as well ?) + # $session->param('lasttime',time()); + # $session->param('ip',$session->remote_addr()); } } # END if ( $userid = $query->param('userid') ) elsif ($type eq "opac") { --