Language: PHP
Label: vulnerable
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
    public function testLogout()
    {
        $sessionMock = $this->getMockBuilder('\Box_Session')
            ->disableOriginalConstructor()
            ->getMock();

        $di = new \Pimple\Container();
        $di['session'] = $sessionMock;
        $di['logger'] = new \Box_Log();

        $adminApi = new \Box\Mod\Profile\Api\Admin();
        $adminApi->setDi($di);
        $result = $adminApi->logout();
        $this->assertTrue($result);
    }