mirror of
https://github.com/discourse/discourse.git
synced 2026-08-14 13:58:53 +08:00
8125ffa60aFollowup 42da6860fd
When the upcoming change for "Impersonate without logout" was added, we
didn't take into account that the "stop impersonation" action would not
work if the Staff enabled option for the upcoming change was used.
This was happening because in the ImpersonateController#destroy action
we werecheckingif the current user had `impersonate_without_logout`
enabled, but we should be checking if the acting user had that
permission instead (i.e. the original admin not the user they are
impersonating)
c.f.
https://meta.discourse.org/t/new-bug-with-experimental-impersonation-interface/395621
40 lines
1.1 KiB
Ruby
Vendored
40 lines
1.1 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class Admin::ImpersonateController < Admin::AdminController
|
|
skip_before_action :ensure_admin, only: :destroy
|
|
|
|
def create
|
|
params.require(:username_or_email)
|
|
|
|
user = User.find_by_username_or_email(params[:username_or_email])
|
|
raise Discourse::NotFound if user.blank?
|
|
|
|
guardian.ensure_can_impersonate!(user)
|
|
|
|
StaffActionLogger.new(current_user).log_impersonate(user)
|
|
|
|
if UpcomingChanges.enabled_for_user?(:impersonate_without_logout, current_user)
|
|
raise Discourse::InvalidAccess if current_user.is_impersonating
|
|
|
|
start_impersonating_user(user)
|
|
else
|
|
log_on_user(user, impersonate: true)
|
|
end
|
|
|
|
render body: nil
|
|
end
|
|
|
|
def destroy
|
|
unless UpcomingChanges.enabled_for_user?(:impersonate_without_logout, impersonation_acting_user)
|
|
raise Discourse::NotFound
|
|
end
|
|
|
|
raise Discourse::InvalidAccess unless current_user.is_impersonating
|
|
|
|
impersonated_user = current_user
|
|
stop_impersonating_user
|
|
StaffActionLogger.new(current_user).log_stop_impersonation(impersonated_user)
|
|
|
|
render body: nil
|
|
end
|
|
end
|
