<?php
//include_once('../session.lib.php');
header( 'Cache-Control: no-store, no-cache, must-revalidate' );
header( 'Cache-Control: post-check=0, pre-check=0', false );
header( 'Pragma: no-cache' ); 
include_once('../session.lib.php');
require_once('../config.lib.php');
require_https();
// Only log out from our own logout link, which carries the CSRF token
if (!csrf_valid($_GET['token'] ?? '')) {
  header("Location: /");
  exit;
}
if (isset($_SESSION['editor'])) {
  if (isset($_COOKIE[session_name()])) {
    // The browser only removes the cookie if domain, path and flags match
    $params = session_get_cookie_params();
    setcookie(session_name(), '', array(
      'expires'  => strtotime('-1 day'),
      'path'     => $params['path'],
      'domain'   => $params['domain'],
      'secure'   => $params['secure'],
      'httponly' => $params['httponly'],
      'samesite' => $params['samesite'],
    ));
  }
  unset($_SESSION['editor']);
  session_destroy();
}
delete_persistent_login();
$referrer = (string)($_SESSION['referrer'] ?? '');
unset($_SESSION['referrer']);
if (is_local_path($referrer) && !preg_match("/logout(\.php)?$/i", $referrer))
  header('Location: ' . $referrer);
else
  header("Location: /");
return;
?>