starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Unable to end other users sessions #3036

New Issue
Closed
opened 2026-04-25 00:13:09 +02:00 by adam · 5 comments
adam commented 2026-04-25 00:13:09 +02:00
Owner
Copy Link
Copy Source

Originally created by @realredknight on GitHub (Oct 13, 2025).

What happened?

in /config/sessions neither my user (Role: admin) nor root are able to end other users sessions.

the UI says "NOT FOUND", while the logs state

ERROR

[SessionController] User "root" attempting to access session belonging to another user "SESSION-ID"

What did you expect to happen?

root and Admin role should be able to end sessions

Steps to reproduce the issue

  1. start a session with another user
  2. open config/sessions
  3. click on the session
  4. click "Close Open Session"

Audiobookshelf version

v2.30.0

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

Additional Notes

No response

Originally created by @realredknight on GitHub (Oct 13, 2025). ### What happened? in /config/sessions neither my user (Role: admin) nor root are able to end other users sessions. the UI says "NOT FOUND", while the logs state ``` ERROR [SessionController] User "root" attempting to access session belonging to another user "SESSION-ID" ``` ### What did you expect to happen? root and Admin role should be able to end sessions ### Steps to reproduce the issue 1. start a session with another user 2. open config/sessions 3. click on the session 4. click "Close Open Session" ### Audiobookshelf version v2.30.0 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None ### Logs ```shell ``` ### Additional Notes _No response_
adam added the bug label 2026-04-25 00:13:09 +02:00
adam closed this issue 2026-04-25 00:13:09 +02:00
adam commented 2026-04-25 00:13:10 +02:00
Author
Owner
Copy Link
Copy Source

@Vito0912 commented on GitHub (Oct 13, 2025):

I can reproduce this on the demo server.
I cannot close other users sessions.

Maybe this isn't a feature, but iirc I could close some sessions of other users some time back. Maybe I remember wrongly

I will look into it today afternoon ~in 4 hours unless someone other wants to do it.
If someone does investigate this issue too, please say so we do not have to do double the work

@Vito0912 commented on GitHub (Oct 13, 2025): I can reproduce this on the demo server. I cannot close other users sessions. Maybe this isn't a feature, but iirc I could close some sessions of other users some time back. Maybe I remember wrongly I will look into it today afternoon ~in 4 hours unless someone other wants to do it. If someone does investigate this issue too, please say so we do not have to do double the work
adam commented 2026-04-25 00:13:10 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Oct 13, 2025):

Thanks, I'm not sure how that bug was there for a year without anyone reporting it

@advplyr commented on GitHub (Oct 13, 2025): Thanks, I'm not sure how that bug was there for a year without anyone reporting it
adam commented 2026-04-25 00:13:10 +02:00
Author
Owner
Copy Link
Copy Source

@realredknight commented on GitHub (Oct 14, 2025):

Looking on your fix, I have another question :)

There is a check whether the requested session belongs to the requesting user. But restricted users can't see /config/sessions - so they can never enter this point. Or do I get something wrong?

(maybe not part of this bug)

@realredknight commented on GitHub (Oct 14, 2025): Looking on your fix, I have another question :) There is a check whether the requested session belongs to the requesting user. But restricted users can't see /config/sessions - so they can never enter this point. Or do I get something wrong? (maybe not part of this bug)
adam commented 2026-04-25 00:13:10 +02:00
Author
Owner
Copy Link
Copy Source

@Vito0912 commented on GitHub (Oct 14, 2025):

There is a check whether the requested session belongs to the requesting user. But restricted users can't see /config/sessions - so they can never enter this point. Or do I get something wrong?

I asked myself exactly this too after I saw the code yesterday. But after thinking about it, it's quite logical:

Apps should be able to close its own sessions, even if they don't have a list of the open ones

@Vito0912 commented on GitHub (Oct 14, 2025): > There is a check whether the requested session belongs to the requesting user. But restricted users can't see /config/sessions - so they can never enter this point. Or do I get something wrong? I asked myself exactly this too after I saw the code yesterday. But after thinking about it, it's quite logical: Apps should be able to close its own sessions, even if they don't have a list of the open ones
adam commented 2026-04-25 00:13:10 +02:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 2, 2025):

Fixed in v2.31.0.

@github-actions[bot] commented on GitHub (Dec 2, 2025): Fixed in [v2.31.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.31.0).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3036
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?