Line 540 of DiffusionController.php is:
$user = id(new PhabricatorPeopleQuery())
>>> ->setViewer(new PhabricatorUser())
->withUsernames(array($username))
->executeOne();
if (!$user) {
// Username doesn't match anything.
return null;
}This should be:
$user = id(new PhabricatorPeopleQuery())
>>> ->setViewer(PhabricatorUser::getOmnipotentUser())
->withUsernames(array($username))
->executeOne();
if (!$user) {
// Username doesn't match anything.
return null;
}Otherwise if the default, anonymous user can't search for the user list, then the authentication will always fail.