From 96615fb27b53ba5997673fcd260b4c7943c9dee8 Mon Sep 17 00:00:00 2001
From: Yannick Warnier <yannick.warnier@beeznest.com>
Date: Fri, 10 Oct 2008 05:07:53 +0200
Subject: [PATCH] [svn r16483] Important and dangerous logic changes in
 "login_as" feature to completely clean the $_user array before reassigning it
 to login_as values. Might have side-effects (although it shouldn't). To be
 watched closely.

---
 main/admin/user_list.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/main/admin/user_list.php b/main/admin/user_list.php
index df2294ae16..bb1942acdb 100644
--- a/main/admin/user_list.php
+++ b/main/admin/user_list.php
@@ -1,4 +1,4 @@
-<?php // $Id: user_list.php 16070 2008-08-26 15:25:28Z elixir_inter $
+<?php // $Id: user_list.php 16483 2008-10-10 03:07:53Z yannoo $
 /*
 ==============================================================================
 	Dokeos - elearning and course management software
@@ -133,14 +133,15 @@ api_protect_admin_script();
 function login_user($user_id)
 {	
 	//init ---------------------------------------------------------------------
-	global $uidReset, $loginFailed, $_configuration;
+    //Load $_user to be sure we clean it before logging in
+	global $uidReset, $loginFailed, $_configuration, $_user;
 
 	$main_user_table = Database :: get_main_table(TABLE_MAIN_USER);
 	$main_admin_table = Database :: get_main_table(TABLE_MAIN_ADMIN);
 	$track_e_login_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_LOGIN);
 
 	//logic --------------------------------------------------------------------
-	//unset($_user['user_id']); // uid not in session ? prevent any hacking
+	unset($_user['user_id']); // uid not in session ? prevent any hacking
 	if (!isset ($user_id))
 	{
 		$uidReset = true;
@@ -210,6 +211,7 @@ function login_user($user_id)
 			$_user['official_code'] = $user_data['official_code'];
 			$_user['picture_uri'] 	= $user_data['picture_uri'];
 			$_user['user_id']		= $user_data['user_id'];
+            $_user['status']        = $user_data['status'];
 
 			$is_platformAdmin = (bool) (!is_null($user_data['is_admin']));
 			$is_allowedCreateCourse = (bool) ($user_data['status'] == 1);