Should a message be logged on logout while masquerading?

Created on 28 July 2023, 11 months ago
Updated 28 May 2024, 28 days ago

Problem/Motivation

I noticed that in Drupal 7, there is a masquerade_user_logout implementation of hook_user_logout. If the user was masquerading, it logs a message stating that the user is no longer masquerading as (user).

In Drupal 8+, Masquerade does no such thing. So if you masquerade as a user, and then log out, the logs show that target user logging out, with no indication that the masquerader stopped masquerading.

Steps to reproduce

  1. Masquerade as a target user.
  2. Visit /user/logout
  3. View the logs

Proposed resolution

Log a message in that case, stating that the user has stopped masquerading. Or, instead of being able to log out while another user, should the "log out" route and link be altered to "unmasquerade" instead if masquerading?

Remaining tasks

Decide what to do.

User interface changes

API changes

Data model changes

πŸ“Œ Task
Status

Active

Version

2.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @solideogloria
  • It is handled in src/Masquerade.php

    public function switchBack() {
        if (!$this->isMasquerading()) {
          return FALSE;
        }
        // Load previous user account.
        $user = $this->userStorage->load($this->getMasquerade());
        if (!$user) {
          // Ensure the flag is cleared.
          $this->session->remove('masquerading');
          // User could be canceled while masquerading.
          return FALSE;
        }
    
        $account = $this->switchUser($user);
    
        // Clear the masquerading flag after switching the user so that hook
        // implementations can differentiate this from a real logout/login.
        $this->session->getMetadataBag()->clearMasquerade();
    
        $this->logger->info('User %username stopped masquerading as %old_username.', [
          '%username' => $user->getDisplayName(),
          '%old_username' => $account->getDisplayName(),
          'link' => $user->toLink($this->t('view'))->toString(),
        ]);
        return TRUE;
      }
    
  • Yes, but that event doesn't happen if a user logs out while masquerading, instead of clicking "unmasquerade".

  • Assigned to rishabjasrotia
  • Issue was unassigned.
Production build 0.69.0 2024