Backported r3080 from trunk (#4248).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/0.8-stable@3081 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/account_controller.rb

@@ -188,12 +188,12 @@ class AccountController < ApplicationController
   
 private
   def logged_user=(user)
+    reset_session
     if user && user.is_a?(User)
       User.current = user
       session[:user_id] = user.id
     else
       User.current = User.anonymous
-      session[:user_id] = nil
     end
   end
 end

test/integration/account_test.rb

@@ -147,6 +147,24 @@ class AccountTest < ActionController::IntegrationTest
     assert user.hashed_password.blank?
   end
   
+  def test_login_and_logout_should_clear_session
+    get '/login'
+    sid = session.session_id
+    
+    post '/login', :username => 'admin', :password => 'admin'
+    assert_redirected_to 'my/page'
+    assert_not_equal sid, session.session_id, "login should reset session"
+    assert_equal 1, session[:user_id]
+    sid = session.session_id
+    
+    get '/'
+    assert_equal sid, session.session_id
+      
+    get '/logout'
+    assert_not_equal sid, session.session_id, "logout should reset session"
+    assert_nil session[:user_id]
+  end
+  
   else
     puts 'Mocha is missing. Skipping tests.'
   end