Logout existing sessions after a username or password change

Closes qbittorrent#18443

Author: Func86

Diff for: src/webui/api/authcontroller.cpp

@@ -45,11 +45,15 @@ AuthController::AuthController(ISessionManager *sessionManager, IApplication *ap
 
 void AuthController::setUsername(const QString &username)
 {
+    if (!m_username.isEmpty() && m_username != username)
+        m_sessionManager->logoutAllSessions();
     m_username = username;
 }
 
 void AuthController::setPasswordHash(const QByteArray &passwordHash)
 {
+    if (!m_passwordHash.isEmpty() && m_passwordHash != passwordHash)
+        m_sessionManager->logoutAllSessions();
     m_passwordHash = passwordHash;
 }
 

Diff for: src/webui/api/isessionmanager.h

@@ -45,4 +45,5 @@ struct ISessionManager
     virtual ISession *session() = 0;
     virtual void sessionStart() = 0;
     virtual void sessionEnd() = 0;
+    virtual void logoutAllSessions() = 0;
 };

Diff for: src/webui/webapplication.cpp

@@ -299,6 +299,12 @@ const Http::Environment &WebApplication::env() const
     return m_env;
 }
 
+void WebApplication::logoutAllSessions()
+{
+	qDeleteAll(m_sessions);
+	m_sessions.clear();
+}
+
 void WebApplication::setUsername(const QString &username)
 {
     m_authController->setUsername(username);

Diff for: src/webui/webapplication.h

@@ -111,6 +111,7 @@ class WebApplication final : public ApplicationComponent<QObject>
     WebSession *session() override;
     void sessionStart() override;
     void sessionEnd() override;
+    void logoutAllSessions() override;
 
     void doProcessRequest();
     void configure();