fixing vuln where someone could change his username after loging in and therefore login with any account

2025-03-31 15:45:35 +00:00
parent 23168103ff
commit bdac5a04bb
1 changed files with 1 additions and 0 deletions
--- a/app-code/api/login/set_username.php
+++ b/app-code/api/login/set_username.php
@@ -1,5 +1,6 @@
 <?php
 session_start();
 $_SESSION["needs_auth"]=true;
+$_SESSION["logged_in"]=false;
 $_SESSION["username"]=preg_replace("/[^a-z0-9_]/","",$_POST["username"]);
 ?>