Probably caused by something misconfigured about the comments plugin.

Config

My setup file:

# comments plugin
# PageSpec of pages where comments are allowed
comments_pagespec: forum/* or blog/posts/* or tarefa/*
# PageSpec of pages where posting new comments is not allowed
comments_closed_pagespec: ''
# Base name for comments, e.g. "comment_" for pages like "sandbox/comment_12"
comments_pagename: comment_
# Interpret directives in comments?
#comments_allowdirectives: 0
# Allow anonymous commenters to set an author name?
comments_allowauthor: 1
# commit comments to the VCS
comments_commit: 1
# Restrict formats for comments to (no restriction if empty)
comments_allowformats: mdwn txt

The moderatedcomments plugins is not enabled

The anonok plugin is not enabled

What are your complete add_plugins and disable_plugins options? Which version of ikiwiki are you running? Are you using any third-party plugins or patches? --smcv

Pasted here

I asked three questions and you gave one answer. Please answer the other two questions. --smcv

Steps

I've tried to place a comment clicking in the obvious Add a comment in a forum post.

I've not signed in because the sign in page didn't come up, instead a simple (You might want to Signin first?) showed up, which I've haven't read and commented away.

Results

As a consequence of that, the user '' - that's a null character, have somehow logged in and it seems that there is no way to log it out.

None of this phantom user edits are being commited - this blog post was made with that user logged in via web.

It seems I can't log out from nowhere. I've rebuild the wiki from the command line and restarted the nginx server, the phantom user remains logged in and open to anyone willing to edit away the wiki.

I wonder whether this might be caused by the combination of the httpauth plugin with the nginx web server. httpauth is known to work correctly with Apache, but you might be the first to use it with nginx.

Specifically, I wonder whether $cgi->remote_user() might be returning the empty string. Looking at the code, we expect it to be either a non-empty username, or undef.

Please try installing this CGI script on your nginx server, making it executable and accessing its URL without carrying out any special HTTP authentication (you can delete the script immediately afterwards if you want). If my theory is right, you will see a line REMOTE_USER= in the output. Post the output somewhere, or mail it to smcv at debian.org if you don't want to make it public.

#!/bin/sh
printf 'Content-type: text/plain\r\n\r\n'
env | LC_ALL=C sort

If you do not intend to use HTTP basic authentication, please do not enable the httpauth plugin. That plugin is intended to be used in conjunction with a web server configured to require HTTP basic authentication with one of a limited set of authorized usernames.

--smcv

If my theory is correct, ikiwiki git master now works around this, and the httpauth documentation now recommends a more correct configuration. --smcv

Conclusion

If I wanted to do a totally anonnymous wiki, this would be the best setup ever.

For this particular installation, that's not the case.

Question

Is there a session file or something to logout this phantom user?

See inside dot ikiwiki. .ikiwiki/userdb is a Perl Storable file; there are instructions for inspecting it on that page. .ikiwiki/sessions.db is most likely a Berkeley DB file.

I would be interested to see the contents of these two files and the complete .setup file. I would also be interested to see a tarball of the entire wiki source directory, if it isn't excessively large. If you'd be willing to share them, please contact smcv@debian.org. --smcv

I think I've sent right away when you asked, anyway I still have the tarball hanging around. The last iikb domains will expire next month though, the wiki will only be accessible by mirror https://notabug.org/iikb/dev.iikb.org.

I see from the tarball that you have a lot of uncommitted changes. This is probably because whatever is causing the anonymous accesses to succeed is breaking other code paths by giving them an empty username: in particular it seems reasonably likely that the git plugin will refuse to commit changes in that situation.

I would expect that you should be getting error messages on the ikiwiki CGI script's stderr in this situation. In Apache they would normally end up in error.log; I don't know how nginx does logging, but it is probably something similar. Please check that log for relevant-looking error messages. --smcv