modolabs/Kurogo-Mobile-Web — pull request #42 by adamfranco (2011-11-28 14:33:53+00:00)
Title: Log out of the CAS server when logging out of Kurogo.

This patch works because phpCAS itself calls

session_unset();
session_destroy();

in its `logout()` function before redirecting the user to the CAS server to log out there. That said, the following code in Session::logout() doesn't get called due to the redirect and exit() in phpCAS:

unset($this->users[$authority->getAuthorityIndex()]);
$this->setSessionVars();
$this->setLoginCookie();
session_regenerate_id(true);

Ideally, the phpCAS::logout() function should be called via a hook that runs after the Kurogo Session::logout() code has finished cleaning up the session(). Without such a hook available however, this patch is probably the best option.