Craig

Thanks Samuel, I have updated the Debian bug tracker with some more details.
I thought the underlying problem was that if you logout then someone could use the cookies to “revive” the session. As I didn’t report this and have adopted the Debian package only recently that take might be wrong. I was surprised by that, because session_destroy() is supposed to make that not happen.

OK, I got the fix for this. The problem is Debian installations don’t use wp-config, but /etc/wordpress/config-<site>.php

I’m not sure how this can be handled without breaking other sites, but if you are running the Debian wordpress packages, edit line 15 of wp-slimstat-js.php from:
$wp_config = file_get_contents($wp_root_folder.'/wp-config.php');

to look like:

$debian_server = preg_replace('/:.*/', "", $_SERVER['HTTP_HOST']);
$debian_server = preg_replace("/[^a-zA-Z0-9.\-]/", "", $debian_server);
$debian_file = '/etc/wordpress/config-'.strtolower($debian_server).'.php';
/* Main site in case of multisite with subdomains */
$debian_main_server = preg_replace("/^[^.]*\./", "", $debian_server);
$debian_main_file = '/etc/wordpress/config-'.strtolower($debian_main_server).'.php';
if (file_exists($debian_file)) {
        $wp_config = file_get_contents($debian_file);
} elseif (file_exists($debian_main_file)) {
        $wp_config = file_get_contents($debian_main_file);
} else
        die("Cannot open config file");