I have a rhodecode 1.3.6 installation at http://inggit.flipnation.ph/, and I found out today that one of my teammates is logged in, from my laptop which he doesn't have access to.
So I checked in other computers: my rhodecode site displays my teammate as logged in, even though he hasn't logged in from there.
There isn't supposed to be any anonymous access to that site, and that user account logged in right now is not an admin. I am the only one with access to the admin account.
I tried logging him out, but nothing happens, he is still displayed as logged in. Everytime I try to log him out, these three messages show up in the log:
2012-06-06 02:21:21.444 INFO [rhodecode.lib.base] User: <AuthUser('id:None:None|False')> accessed /_admin/logout 2012-06-06 02:21:21.448 INFO [rhodecode.controllers.login] Logging out and deleting session for user 2012-06-06 02:21:21.452 INFO [rhodecode.lib.base] Request to /_admin/logout time: 0.044s
Just tell me whatever log or file you need to see.