fossar / selfoss

multipurpose rss reader, live stream, mashup, aggregation web application
https://selfoss.aditu.de
GNU General Public License v3.0
2.35k stars 343 forks source link

Web client allows to “sign in” when authentication is disabled #1380

Open jtojnar opened 1 year ago

jtojnar commented 1 year ago

When authentication is disabled, user can still visit the sign in page and enter any credentials. The app then switches to a signed in mode. When user then clicks the log out button, they will see an HTTP 500 error due to:

session_destroy(): Trying to destroy uninitialized session