Browse Source

Fix login_as for HRM see BT#13481

jmontoyaa 7 years ago
parent
commit
9d1a057781
2 changed files with 45 additions and 42 deletions
  1. 3 1
      main/admin/user_information.php
  2. 42 41
      main/admin/user_list.php

+ 3 - 1
main/admin/user_information.php

@@ -63,7 +63,7 @@ $actions = [
     )
 ];
 
-if (api_is_platform_admin()) {
+if (api_can_login_as($userId)) {
     $actions[] = Display::url(
         Display::return_icon(
             'login_as.png',
@@ -73,7 +73,9 @@ if (api_is_platform_admin()) {
         ),
         api_get_path(WEB_CODE_PATH).'admin/user_list.php?action=login_as&user_id='.$userId.'&sec_token='.Security::getTokenFromSession()
     );
+}
 
+if (api_is_platform_admin()) {
     $actions[] = Display::url(
         Display::return_icon(
             'edit.png',

+ 42 - 41
main/admin/user_list.php

@@ -12,11 +12,51 @@ use ChamiloSession as Session;
 $cidReset = true;
 require_once __DIR__.'/../inc/global.inc.php';
 
-api_protect_admin_script(true);
-
 $urlId = api_get_current_access_url_id();
 $action = isset($_REQUEST['action']) ? $_REQUEST['action'] : '';
 
+// Login as can be used by different roles
+if (isset($_GET['user_id']) && $action == 'login_as') {
+    $check = Security::check_token('get');
+    if ($check && api_can_login_as($_GET['user_id'])) {
+        $result = UserManager::loginAsUser($_GET['user_id']);
+        if ($result) {
+            $userInfo = api_get_user_info();
+            $firstname = $userInfo['firstname'];
+            $lastname = $userInfo['lastname'];
+            $userId = $userInfo['id'];
+
+            if (api_is_western_name_order()) {
+                $message = sprintf(
+                    get_lang('AttemptingToLoginAs'),
+                    $firstname,
+                    $lastname,
+                    $userId
+                );
+            } else {
+                $message = sprintf(
+                    get_lang('AttemptingToLoginAs'),
+                    $lastname,
+                    $firstname,
+                    $userId
+                );
+            }
+
+            $target_url = api_get_path(WEB_PATH)."user_portal.php";
+            $message .= '<br />'.sprintf(get_lang('LoginSuccessfulGoToX'), '<a href="'.$target_url.'">'.$target_url.'</a>');
+            Display::display_header(get_lang('UserList'));
+            echo Display::return_message($message, 'normal', false);
+            Display::display_footer();
+            exit;
+        } else {
+            api_not_allowed(true);
+        }
+    }
+    Security::clear_token();
+}
+
+api_protect_admin_script(true);
+
 // Blocks the possibility to delete a user
 $deleteUserAvailable = true;
 if (api_get_configuration_value('deny_delete_users')) {
@@ -152,45 +192,6 @@ function load_calendar(user_id, month, year) {
 
 $this_section = SECTION_PLATFORM_ADMIN;
 
-if ($action == 'login_as') {
-    $check = Security::check_token('get');
-    if (isset($_GET['user_id']) && $check) {
-        $result = UserManager::loginAsUser($_GET['user_id']);
-        if ($result) {
-            $userInfo = api_get_user_info();
-            $firstname = $userInfo['firstname'];
-            $lastname = $userInfo['lastname'];
-            $userId = $userInfo['id'];
-
-            if (api_is_western_name_order()) {
-                $message = sprintf(
-                    get_lang('AttemptingToLoginAs'),
-                    $firstname,
-                    $lastname,
-                    $userId
-                );
-            } else {
-                $message = sprintf(
-                    get_lang('AttemptingToLoginAs'),
-                    $lastname,
-                    $firstname,
-                    $userId
-                );
-            }
-
-            $target_url = api_get_path(WEB_PATH)."user_portal.php";
-            $message .= '<br />'.sprintf(get_lang('LoginSuccessfulGoToX'), '<a href="'.$target_url.'">'.$target_url.'</a>');
-            Display :: display_header(get_lang('UserList'));
-            echo Display::return_message($message, 'normal', false);
-            Display :: display_footer();
-            exit;
-        } else {
-            api_not_allowed(true);
-        }
-    }
-    Security::clear_token();
-}
-
 /**
  * Prepares the shared SQL query for the user table.
  * See get_user_data() and get_number_of_users().