diff --git a/app/concerns/authenticated_system.rb b/app/concerns/authenticated_system.rb index 8726add..db82d73 100644 --- a/app/concerns/authenticated_system.rb +++ b/app/concerns/authenticated_system.rb @@ -2,15 +2,18 @@ module AuthenticatedSystem protected - def self.included base - if base < ActionController::Base - base.around_filter :user_set_current - base.before_filter :login_from_cookie + extend ActiveSupport::Concern + + included do + if self < ActionController::Base + around_filter :user_set_current + before_filter :override_user + before_filter :login_from_cookie end # Inclusion hook to make #current_user and #logged_in? # available as ActionView helper methods. - base.helper_method :current_user, :logged_in? + helper_method :current_user, :logged_in? end # Returns true or false if the user is logged in. @@ -20,10 +23,9 @@ module AuthenticatedSystem end # Accesses the current user from the session. - def current_user + def current_user user_id = session[:user] @current_user ||= begin - id = session[:user] - user = User.where(id: id).first if id + user = User.find_by id: user_id if user_id user.session = session if user User.current = user user @@ -141,6 +143,13 @@ module AuthenticatedSystem end end + def override_user + return if params[:override_user].blank? + return unless logged_in? and user.is_admin? environment + @current_user = nil + current_user params[:override_user] + end + # When called with before_filter :login_from_cookie will check for an :auth_token # cookie and log the user back in if apropriate def login_from_cookie diff --git a/app/helpers/url_helper.rb b/app/helpers/url_helper.rb index 01fb3a7..c062bdc 100644 --- a/app/helpers/url_helper.rb +++ b/app/helpers/url_helper.rb @@ -4,4 +4,12 @@ module UrlHelper 'javascript:history.back()' end + def default_url_options + options = {} + + options[:override_user] = params[:override_user] if params[:override_user].present? + + options + end + end diff --git a/test/functional/application_controller_test.rb b/test/functional/application_controller_test.rb index d9d8e9a..4d701e1 100644 --- a/test/functional/application_controller_test.rb +++ b/test/functional/application_controller_test.rb @@ -506,6 +506,21 @@ class ApplicationControllerTest < ActionController::TestCase assert_redirected_to :controller => 'account', :action => 'login' end + should 'override user when current is an admin' do + user = create_user + other_user = create_user + environment = Environment.default + login_as user.login + @controller.stubs(:environment).returns(environment) + + get :index, override_user: other_user.id + assert_equal user, assigns(:current_user) + + environment.add_admin user.person + get :index, override_user: other_user.id + assert_equal other_user, assigns(:current_user) + end + should 'do not allow member not included in whitelist to access an restricted environment' do user = create_user e = Environment.default diff --git a/test/unit/url_helper_test.rb b/test/unit/url_helper_test.rb new file mode 100644 index 0000000..001294b --- /dev/null +++ b/test/unit/url_helper_test.rb @@ -0,0 +1,15 @@ +require 'test_helper' + +class UrlHelperTest < ActionView::TestCase + + include UrlHelper + + def setup + end + + should 'preserve override_user if present' do + params[:override_user] = 1 + assert_equal default_url_options[:override_user], params[:override_user] + end + +end -- libgit2 0.21.2