@@ -, +, @@ --- C4/Auth.pm | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -698,6 +698,10 @@ sub checkauth { -expires => '', -HttpOnly => 1, ); + + # Unset the userenv as we don't have a sessionID anyway, and it risks + # getting the environment for another user, which is quite bad. + C4::Context::_new_userenv(undef); $loggedin = check_user_exists($userid); } elsif ( $persona ){ # we dont want to set a session because we are being called by a persona callback @@ -886,7 +890,7 @@ sub checkauth { $return = $value ? 1 : 0; $userid = $value; - } + } else { my $retuserid; ( $return, $cardnumber, $retuserid ) = --