I'm suspecting an undesired behaviour using getpermission in knop_user.

Doing a check like this:
if( $session_user -> getpermission( 'doGood'));

evaluates as true even if user has logged out using:
$session_user -> logout;

I suggest that either getpermission check that a user is still
authenticated or that -> logout clears all permissions. Or both.

HDB
Jolle

#############################################################
This message is sent to you because you are subscribed to
the mailing list <knop@lists.montania.se>.
To unsubscribe, E-mail to: <knop-off@lists.montania.se>
Send administrative queries to <knop-request@lists.montania.se>
List archive http://www.nabble.com/Knop-Framework-Discussion-f29076.html
Project homepage http://montania.se/projects/knop/
Google Code has the latest downloads at http://code.google.com/p/knop/