Language: PHP
Label: vulnerable
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
    public function testLogoutClient()
    {
        $sessionMock = $this->getMockBuilder("\Box_Session")
            ->disableOriginalConstructor()
            ->getMock();

        $sessionMock->expects($this->atLeastOnce())
            ->method("delete");

        $di            = new \Pimple\Container();
        $di['logger']  = new \Box_Log();
        $di['session'] = $sessionMock;

        $model = new \Model_Client();
        $model->loadBean(new \DummyBean());

        $service = new Service();
        $service->setDi($di);
        $result = $service->logoutClient($model, 'new password');
        $this->assertTrue($result);
    }