Admin: ensure "login_as" flag is off anytime we logout or login with username/password directly

Author: ywarnier

main/inc/lib/online.inc.php

@@ -217,6 +217,10 @@ function online_logout($user_id = null, $logout_redirect = false)
     }
 
     api_delete_firstpage_parameter();
+    // If we were using "login_as", make sure this doesn't stick to the session
+    if (Session::read('login_as') !== null) {
+        Session::erase('login_as');
+    }
     Session::erase('last_id');
     CourseChatUtils::exitChat($user_id);
     session_regenerate_id();

main/inc/local.inc.php

@@ -461,6 +461,8 @@
             $login = $_POST['login'];
             $password = $_POST['password'];
         }
+        // unset the "login_as" flag if we just connected with a username and password.
+        Session::erase('login_as');
 
         $userManager = UserManager::getManager();
         $userRepository = UserManager::getRepository();