<?php
//include_once('../session.lib.php');
header( 'Cache-Control: no-store, no-cache, must-revalidate' );
header( 'Cache-Control: post-check=0, pre-check=0', false );
header( 'Pragma: no-cache' ); 
include_once('../session.lib.php');
if ( ! isset($_SERVER['HTTPS'])) {
   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
   exit;
}
// Only log out from our own logout link, which carries the CSRF token
if (!csrf_valid($_GET['token'] ?? '')) {
  header("Location: https://xxx.org.za/");
  exit;
}
if (isset($_SESSION['editor'])) {
  if (isset($_COOKIE[session_name()])) {
    // The browser only removes the cookie if domain, path and flags match
    $params = session_get_cookie_params();
    setcookie(session_name(), '', array(
      'expires'  => strtotime('-1 day'),
      'path'     => $params['path'],
      'domain'   => $params['domain'],
      'secure'   => $params['secure'],
      'httponly' => $params['httponly'],
      'samesite' => $params['samesite'],
    ));
  }
  unset($_SESSION['editor']);
  session_destroy();
}
delete_persistent_login();
if (isset($_SESSION['referrer'])) {
  $url  = $_SERVER['HTTPS'] ? "https://" : "http://";
  $url .= $_SERVER['HTTP_HOST'];
  $url .= $_SESSION['referrer'];
  unset($_SESSION['referrer']);
  if (preg_match("/logout(\.php)?$/i", $url)) {
    $url = "/";
  }
  header("Location: $url");
  return;
} else {
  header("Location: https://xxx.org.za/");
  return;
}
?>