Merged in release/3.2.3 (pull request #6488)

HOR-4600

Approved-by: Paula Quispe <paula.quispe@processmaker.com>
Approved-by: Julio Cesar Laura Avendaño <contact@julio-laura.com>

workflow/engine/methods/login/login.php

@@ -252,6 +252,11 @@ if ($timeZoneFailed) {
     $G_PUBLISH->AddContent('xmlform', 'xmlform', 'login' . PATH_SEP . 'TimeZoneAlert', '', $arrayData, SYS_URI . 'login/authentication.php');
 
     G::RenderPage('publish');
+
+    // Destroy a significant value in session
+    global $G_FORM;
+    unset($_SESSION[$G_FORM->id]['USR_PASSWORD']);
+
     exit(0);
 }
 /*----------------------------------********---------------------------------*/

workflow/engine/methods/login/sysLoginVerify.php

@@ -36,6 +36,8 @@ if (!isset($_POST)) {
 }
 if (isset($_SESSION['sysLogin'])) {
     $_POST['form'] = $_SESSION['sysLogin'];
+    // Destroy variables already assigned to the global variable $_POST
+    unset($_SESSION['sysLogin']);
 }
 
 require_once 'authentication.php';