Security bug in q2a

Question

when the user changes his password his account still logged in another browser. If someone hacked my password there is no way to protect the account from hackers.There should be a option to log out of all sessions.

Comments

Good point, opened as an issue: https://github.com/q2a/question2answer/issues/824

Answer 1

It should work for you now.Replace the 232 no line of qa-include/pages/account.php with the code.

if (qa_is_logged_in()) {

 qa_set_logged_in_user(null);

} // remove the session for the user.

Comments

Where is "password changing section" that I can put this function in?

---

Could be that this will not work anyways, see: https://stackoverflow.com/q/6472123/1066234

Answer 2

I posted a reply on the GitHub issue: https://github.com/q2a/question2answer/issues/824#issuecomment-654363679

The short version is that Q2A already implements this, however due to the way web browsers work now the sessions may not actually expire. I'll work on a way to solve it for the next version of Q2A.