Retired Users have still acces to the page

[CedGauche]

Hey,

we have some inactive / retired users, they are still online and writing airmails and downloading stuff etc.

I guess they have cookies or autologin-sessions.

How can we solve that?

thx

[Vangelis]

Can you post your Auth.class.php ?

at about line 286 you should see

 /*if($userinfo->retired == 1)
 {
  self::$error_message = 'Your account was deactivated, please contact an admin';
  return false;
 }*/
 //ok now check it

Commented

uncomment it and you should be fine

 if($userinfo->retired == 1)
 {
  self::$error_message = 'Your account was deactivated, please contact an admin';
  return false;
 }
 //ok now check it

[CedGauche]

Hi,

this is the code:

if($userinfo->retired == 1)

{

self::$error_message = 'Der Account wurde aufgrund von Inaktivität deaktiviert, zum entsperren den Admin / Webmaster kontaktieren.';

return false;

}

I guess the code is uncomment. When I try to login with an retired test account, there is the message,the account is retired and no access. Perfect

But when I never log out from the page and the session cookie is still active, I can acces the page with an retired account.

[Vangelis]

No idea about that but i gues at some point the cookie will expire or after you put a pilot on retired empty the sessions table in mysql

[mseiwald]

In your layout you could just use something like

if(Auth::LoggedIn && Auth::$userinfo->retired == '1')

and then redirect him to the logout url.

[CedGauche]

This is a solution, I will try this..thx