Repository navigation
Conversation
Each user gets an Impersonation setting (administrators only, Access Rights tab of the user form): - Default: follow the general setting (Restrict Impersonation of 'Administration: Settings' Users); - Allowed: the user can always be impersonated, even with the 'Administration: Settings' rights; - Forbidden: the user can never be impersonated. The check is skipped when going back to the original user. Signed-off-by: Claude Perrin <klodr@users.noreply.github.com>
…ction Signed-off-by: Claude Perrin <klodr@users.noreply.github.com>
Contributor
|
Hi @Kev-Roche, |
The "Switch Login" list only shows the users that can be switched to, and the row button of the users list is hidden for the others: oneself, users set to Forbidden, and administrators in Default mode when the general setting restricts them. Same rule as the server-side check, which is unchanged, as a computed field with a SQL search. Signed-off-by: Claude Perrin <klodr@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Today the only way to protect a user from being impersonated is the general setting added in #954, which applies to all users with the Administration: Settings rights. There is no way to:
This PR adds an Impersonation setting on each user (Access Rights tab, visible and editable by administrators only):
The checks are grouped in
_check_can_be_impersonated(), so other modules can extend them. The check is skipped when the impersonating user goes back to their own account.Tests: three new HTTP tests (forbidden user, allowed administrator despite the general restriction, default mode follows the general restriction); the existing tests are unchanged and pass. README regenerated.