Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unwanted user transfer bug #9

Open
aramollis opened this issue Jul 19, 2022 · 0 comments
Open

Unwanted user transfer bug #9

aramollis opened this issue Jul 19, 2022 · 0 comments

Comments

@aramollis
Copy link

Describe the bug

With Decidim 0.26.2, if someone logs in without registering (using this module) and then clicks the logout link in the top bar, the session is apparently logged out. Instead, the next login of the user (administrator user, for example) causes an unexpected and inadvertent transfer of the previous unregistered user to this other account. Note that if this second user session were an admin user, the new associated user would no longer be an admin user.

To Reproduce

Steps to reproduce the behaviour:

  1. Configure any component that requires to be verified to perform some action (comment, vote, ...)
  2. Sign out
  3. Go to the home page of the newly configured component and try to perform the restricted action
  4. You will be prompted to login or verify without user account, choose "verify without user account"
  5. Complete the data required by the census 'Number of VAT, etc'
  6. Now you are logged in as a new user session, you can perform any action. Then sign out.
  7. Within a few minutes, if you try to log in with the credentials of another pre-existing user (administrator user, for example), even in a new browser session, their account will be logged in with the previous "verified but not registered user" and will be will automatically transfer to it.

Expected behavior

When the verified unregistered user clicks log out, they should be logged out with no possibility of any other user accessing it, neither accidentally transferring their account to this user.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant