I'd have thought ensuring a session ID was only valid for a single account would have been the first thing to test when developing an authentication system. Perhaps not in Sweden.
It's obvious it was a bug introduced somewhere, (actually seemed like something was commented out for testing purposes and was forgotten about to me, maybe that's just because I'm forgetful though) but I'd have hoped there are a few tests that are run before an update is made live which would include something like this.
Comments
I'd have thought ensuring a session ID was only valid for a single account would have been the first thing to test when developing an authentication system. Perhaps not in Sweden.
Yes, because it was clearly not a bug.
It's obvious it was a bug introduced somewhere, (actually seemed like something was commented out for testing purposes and was forgotten about to me, maybe that's just because I'm forgetful though) but I'd have hoped there are a few tests that are run before an update is made live which would include something like this.
Props for the speedy fix though.