discourse/app/controllers/admin/impersonate_controller.rb

# frozen_string_literal: true

class Admin::ImpersonateController < Admin::AdminController
  def create
    params.require(:username_or_email)

    user = User.find_by_username_or_email(params[:username_or_email])
    raise Discourse::NotFound if user.blank?

    guardian.ensure_can_impersonate!(user)

    # log impersonate
    StaffActionLogger.new(current_user).log_impersonate(user)

    # Log on as the user
    log_on_user(user, impersonate: true)

    render body: nil
  end
end
DEV: enable frozen string literal on all files This reduces chances of errors where consumers of strings mutate inputs and reduces memory usage of the app. Test suite passes now, but there may be some stuff left, so we will run a few sites on a branch prior to merging 2019-05-03 06:17:27 +08:00			`# frozen_string_literal: true`

Initial release of Discourse 2013-02-06 03:16:51 +08:00			`class Admin::ImpersonateController < Admin::AdminController`
			`def create`
Enabled strong_parameters across all models/controllers. All models are now using ActiveModel::ForbiddenAttributesProtection, which shifts the responsibility for parameter whitelisting for mass-assignments from the model to the controller. attr_accessible has been disabled and removed as this functionality replaces that. The require_parameters method in the ApplicationController has been removed in favor of strong_parameters' #require method. It is important to note that there is still some refactoring required to get all parameters to pass through #require and #permit so that we can guarantee that parameter values are scalar. Currently strong_parameters, in most cases, is only being utilized to require parameters and to whitelist the few places that do mass-assignments. 2013-06-06 15:14:32 +08:00			`params.require(:username_or_email)`
Initial release of Discourse 2013-02-06 03:16:51 +08:00
fix horribly broken invite code, could lead to inviting the wrong person to a conversation 2013-06-19 08:31:19 +08:00			`user = User.find_by_username_or_email(params[:username_or_email])`
Initial release of Discourse 2013-02-06 03:16:51 +08:00			`raise Discourse::NotFound if user.blank?`

			`guardian.ensure_can_impersonate!(user)`

FEATURE: log impersonations 2014-11-06 17:58:47 +08:00			`# log impersonate`
			`StaffActionLogger.new(current_user).log_impersonate(user)`

Initial release of Discourse 2013-02-06 03:16:51 +08:00			`# Log on as the user`
FIX: Do not check for suspicious login when impersonating. (#6534) * FIX: Do not check for suspicious login when impersonating. * DEV: Add 'impersonate' parameter to log_on_user. 2018-11-12 22:34:12 +08:00			`log_on_user(user, impersonate: true)`
Initial release of Discourse 2013-02-06 03:16:51 +08:00
Fix all the errors to get our tests green on Rails 5.1. 2017-08-31 12:06:56 +08:00			`render body: nil`
Fix all the trailing whitespace 2013-02-07 23:45:24 +08:00			`end`
Initial release of Discourse 2013-02-06 03:16:51 +08:00			`end`