WIP: Security fixes to user impersonation functionality - Githubissues

emoncms / group

In development: Emoncms groups module

GNU Affero General Public License v3.0

4 stars 8 forks source link

WIP: Security fixes to user impersonation functionality #51

Closed takkaria closed 6 years ago

takkaria commented 6 years ago

This is a partial fix to #32 around administrator daisychaining:

If you use the impersonation function once, log in as another person, and then impersonate again, we don't lose track of the originally logged-in user
Ensure that a user that isn't an admin can't impersonate a user that is

Still to do:

[ ] Make clear in the UI what is going on
[ ] Disallow impersonating someone through another account that you couldn't impersonate yourself