You can open the sign up and login pages on Discourse Forums by clicking them in a post despite being a registered user

Contribute Bug
1

Normally, you are not supposed to access these pages when registered. However you can when you click the link a post. Normally both pages kick you back to the home page when you click them.

How to reproduce this bug:

  1. Find or make a post on the forum that has either a /signup or a /login link.
  2. Clicking either of those will take you to the signup or login page even with an account.
  3. If you try to make an account in this state, nothing seems to happen, but it sends an email like the image below.
    image
    image901×486 23.7 KB
  4. If you try to log in to an account in this state, nothing seems to happen, but as soon as you refresh, the account logs you in to a different account.

Videos:


Video 1: The login page

Video 2: The signup page

1 Like
3

One second here, did you use a fresh browser here? Try it in a fresh browser please.

5

I just tried it in a fresh installation of Opera, and I exhibit the same results.
Yes, I know its not Chrome, but it’s based on Chromium. I tried it both for the sign up and login pages.


And it gave the same results

image
image885×313 25.2 KB

Apologies for the technical difficulties, OBS was refusing to record one of the videos, so I resorted to win shift R.
I might’ve been dumb and kept starting the virtual camera by accident however.

1 Like
6

I have this confusion fixed per:

https://github.com/discourse/discourse/pull/43343

It was an oversight that we were missing client size redirects and allowed logged on users to sign up.]

2 Likes