Ticket #6941: clear_session_on_logout_and_login2.diff

django/contrib/auth/__init__.py

@@ -53 +53 @@
     # TODO: It would be nice to support different login methods, like signed cookies.
     user.last_login = datetime.datetime.now()
     user.save()
+    if request.session.get(SESSION_KEY, user.id) != user.id:
+        # a different user was logged in, his data has to be cleared
+        request.session.destroy()
     request.session[SESSION_KEY] = user.id
     request.session[BACKEND_SESSION_KEY] = user.backend
     if hasattr(request, 'user'):
         request.user = user
 
-def logout(request):
+def logout(request, clear_session=True):
     """
-    Remove the authenticated user's ID from the request.
+    Remove the authenticated user's ID from the request and optionally clear
+    the session.
     """
-    try:
-        del request.session[SESSION_KEY]
-    except KeyError:
-        pass
-    try:
-        del request.session[BACKEND_SESSION_KEY]
-    except KeyError:
-        pass
+    if clear_session:
+        request.session.destroy()
+    else:
+        try:
+            del request.session[SESSION_KEY]
+        except KeyError:
+            pass
+        try:
+            del request.session[BACKEND_SESSION_KEY]
+        except KeyError:
+            pass
     if hasattr(request, 'user'):
         from django.contrib.auth.models import AnonymousUser
         request.user = AnonymousUser()