adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

12.1.0 Account/Login false sharing bug #1388

New Issue
Closed
opened 2026-10-05 00:41:57 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:41:57 +02:00
Owner
Copy link
Copy source

Greetings,

I am managing the Piwigo installation of a friend, and I noticed a rather critical issue with the account system:

When my friend currently logs into their account on their computer, whenever I visit the gallery the system thinks I am logged in as that person as well, despite not even knowing their credentials.

This has been reproduced several times with them logging in and out and me essentially having the same login state in my own completely unrelated browser, coming from a completely different IP/ISP.

Setup is NGINX on Debian. I don't know if the issue is new in 12.1 or has beeen present before already.

Greetings, I am managing the Piwigo installation of a friend, and I noticed a rather critical issue with the account system: When my friend currently logs into their account on their computer, whenever I visit the gallery the system thinks *I* am logged in as that person as well, despite not even knowing their credentials. This has been reproduced several times with them logging in and out and me essentially having the same login state in my own completely unrelated browser, coming from a completely different IP/ISP. Setup is NGINX on Debian. I don't know if the issue is new in 12.1 or has beeen present before already. <!-- github-sync-id:1084059290 -->
adam closed this issue 2026-10-05 00:41:57 +02:00
adam commented 2026-10-05 00:41:58 +02:00
Author
Owner
Copy link
Copy source

Update:
I found the reason, and it needs to be pointed out in Documentation when hosting using NGINX:

When Using NGINX + NNGINX Unit for PHP, people do need to make SURE to disable the 'proxy' caching policy between NGINX and NGINX Unit, in order to avoid false account sharing.

Example phpfile.conf entry:

if ($request_uri ~* "\/gallery\/"){
    set $no_cache 1;
}

In this case Piwigo is hosted in the /gallery/ directory.

Update: I found the reason, and it needs to be pointed out in Documentation when hosting using NGINX: When Using NGINX + NNGINX Unit for PHP, people do need to make SURE to disable the 'proxy' caching policy between NGINX and NGINX Unit, in order to avoid false account sharing. Example phpfile.conf entry: if ($request_uri ~* "\/gallery\/"){ set $no_cache 1; } In this case Piwigo is hosted in the /gallery/ directory. <!-- github-comment-id:997365649 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1388