"Masquerade as ROLE" does not grant access when user does not also have "masquerade as authenticated user" permission

Created on 11 November 2020, about 4 years ago
Updated 8 March 2024, 10 months ago

Problem/Motivation

I added the permission "Masquerade as politician" for the users of role "content manager". But users of role "content manager" do not see the masquerade link for politicians - although they have the permission.

Steps to reproduce

  • Create two roles, role A and role B
  • Give permission "Masquerade as role B" and "Administer users" to role A
  • Create two users, one with role A and one with role B
  • Login as user with role A
  • Go to users account page
  • You will not see the masquerade link

Proposed resolution

The problem appears to be this part in masquerade_masquerade_access():

  // Permissions may be granted on a per-role basis.
  $target_account_roles = $target_account->getRoles();
  foreach ($target_account_roles as $role_id) {
    if (!$user->hasPermission("masquerade as $role_id")) {
      return NULL;
    }
  }

The first role the code receives here is "authenticated". As the user should only be allowed to masquerade as role B user this part will return NULL immediately even when the user has the permission to access all other roles.

I understand that the user should only be allowed to masquerade when he has masquerade permissions for all roles the target user has. But now we can add permission for individual roles - but the masqerading user can only masquerade when he has the permission to masquerade as authenticated user - which is the same as the permission "masquerade as any user".

πŸ› Bug report
Status

Needs review

Version

2.0

Component

Code

Created by

πŸ‡©πŸ‡ͺGermany tobiberlin Berlin, Germany

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024