mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-04 20:35:52 +08:00
8125ffa60a
Followup 42da6860fd
When the upcoming change for "Impersonate without logout" was added, we
didn't take into account that the "stop impersonation" action would not
work if the Staff enabled option for the upcoming change was used.
This was happening because in the ImpersonateController#destroy action
we werecheckingif the current user had `impersonate_without_logout`
enabled, but we should be checking if the acting user had that
permission instead (i.e. the original admin not the user they are
impersonating)
c.f.
https://meta.discourse.org/t/new-bug-with-experimental-impersonation-interface/395621
59 lines
1.3 KiB
Ruby
59 lines
1.3 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
module CurrentUser
|
|
def self.has_auth_cookie?(env)
|
|
Discourse.current_user_provider.new(env).has_auth_cookie?
|
|
end
|
|
|
|
def self.lookup_from_env(env)
|
|
Discourse.current_user_provider.new(env).current_user
|
|
end
|
|
|
|
# can be used to pretend current user does no exist, for CSRF attacks
|
|
def clear_current_user
|
|
@current_user_provider = Discourse.current_user_provider.new({})
|
|
end
|
|
|
|
def log_on_user(user, opts = {})
|
|
current_user_provider.log_on_user(user, session, cookies, opts)
|
|
user.logged_in
|
|
end
|
|
|
|
def log_off_user
|
|
current_user_provider.log_off_user(session, cookies)
|
|
end
|
|
|
|
def start_impersonating_user(user)
|
|
current_user_provider.start_impersonating_user(user)
|
|
end
|
|
|
|
def stop_impersonating_user
|
|
current_user_provider.stop_impersonating_user
|
|
end
|
|
|
|
def is_api?
|
|
current_user_provider.is_api?
|
|
end
|
|
|
|
def is_user_api?
|
|
current_user_provider.is_user_api?
|
|
end
|
|
|
|
def current_user
|
|
current_user_provider.current_user
|
|
end
|
|
|
|
def impersonation_acting_user
|
|
current_user_provider.impersonation_acting_user
|
|
end
|
|
|
|
def refresh_session(user)
|
|
current_user_provider.refresh_session(user, session, cookies)
|
|
end
|
|
|
|
private
|
|
|
|
def current_user_provider
|
|
@current_user_provider ||= Discourse.current_user_provider.new(request.env)
|
|
end
|
|
end
|
