From bcb88058f9d98850852ede374725beaa32e8059c Mon Sep 17 00:00:00 2001 From: "Drew Jaynes (DrewAPicture)" Date: Fri, 28 Nov 2014 03:47:43 +0000 Subject: [PATCH] Improve inline documentation in `wp_ajax_destroy_sessions()`. If the token is set (`$keep` is a string), this means the user is viewing their own profile-editing screen and destroying their own sessions (except the current one). If it isn't set (`$keep` is null), the user is editing another user's profile and destroying all of their sessions with no exceptions. See #30264, #30469 git-svn-id: https://develop.svn.wordpress.org/trunk@30595 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/includes/ajax-actions.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php index 36cb488be8..90982d3302 100644 --- a/src/wp-admin/includes/ajax-actions.php +++ b/src/wp-admin/includes/ajax-actions.php @@ -2768,7 +2768,6 @@ function wp_ajax_parse_media_shortcode() { * AJAX handler for destroying multiple open sessions for a user. * * @since 4.1.0 - * */ function wp_ajax_destroy_sessions() { @@ -2792,6 +2791,7 @@ function wp_ajax_destroy_sessions() { ) ); } + // 'token' is only set if the initiating user is viewing their own profile-editing screen. if ( isset( $_POST['token'] ) ) { $keep = wp_unslash( $_POST['token'] ); } else { @@ -2800,6 +2800,11 @@ function wp_ajax_destroy_sessions() { $sessions = WP_Session_Tokens::get_instance( $user->ID ); + /* + * If $keep is a string, then the current user is destroying all of their own sessions + * except the current one. If $keep is not a string, the current user is destroying all + * of another user's sessions with no exceptions. + */ if ( is_string( $keep ) ) { $sessions->destroy_others( $keep ); $message = __( 'You are now logged out everywhere else' );