option DeleteSessionOnLogout qui permet la suppression de la session au logout

README.config

@@ -71,6 +71,9 @@ CacheTime:
 Debug:
     Show debugging information when an error occurs. (default: false)
 
+DeleteSessionOnLogout:
+    (default: false)
+    
 DisableSpellchecking:
     Disable spellchecking (used in <textarea> previews). (default: false)
 

shared/web/IdentitiesWeb.py

@@ -85,8 +85,7 @@ from glasnost.proxy.tools import getProxyForServerRole
 
 import ObjectsWeb as objects
 import things
-from tools import OK, HTTP_NO_CONTENT, accessForbidden, failure, \
-     getWeb, getWebForServerRole, redirect, writePageLayout
+from tools import *
 
 
 class AdminIdentities(objects.AdminMixin, proxyIdentities.AdminIdentities):
@@ -775,14 +774,32 @@ class IdentitiesWeb(objects.ObjectsWebMixin, proxyIdentities.IdentitiesProxy):
     def logout(self):
         self.deleteUserToken()
         session = context.getVar('session')
-        if session is not None:
-            # Don't delete the session, just remove userToken from it.
+
+        if webTools.getConfig('DeleteSessionOnLogout'):
+            if session:
+                try:
+                    getProxyForServerRole('sessions').deleteSession(
+                        context.getVar('sessionToken'))
+                except UnknownSessionToken:
+                    # uh ?
+                    pass
+            nextUri = context.getVar('nextUri') or ''
+            if not nextUri:
+                nextUri = '/'
+            else:
+                nextUri = cleanUpUri(nextUri, ['sessionToken'])
+            return redirect(nextUri)
+        
+
+        # Don't delete the session, just remove userToken from it.
+        if session:
             context.setVar('userId', None)
             context.setVar('user', None)
             if session.has_key('userToken'):
                 del session['userToken']
                 session['isDirty'] = 1
             context.setVar('userToken', '')
+
         # if not context.getVar('sessionTokenInCookie', default = 0):
         #     # The sessionToken was not stored in a cookie, so don't try to
         #     # use