- Patch #138531 by bjaspan: destroy existing sessions when a user password is changed.

1 files changed, 7 insertions, 0 deletions

diff --git a/modules/user/user.module b/modules/user/user.module
index 427f232ab..ff60af77d 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -193,6 +193,13 @@ function user_save($account, $array = array(), $category = 'account') {
       sess_destroy_uid($account->uid);
     }
 
+    // If the password changed, delete all open sessions and recreate
+    // the current one.
+    if (isset($array['pass'])) {
+      sess_destroy_uid($account->uid);
+      sess_regenerate();
+    }
+
     // Refresh user object
     $user = user_load(array('uid' => $account->uid));
     user_module_invoke('after_update', $array, $user, $category);