Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-16 22:41:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

enhance(admin): show impersonation banner and keep password change with the user (#38924)

Browse Source 
Follow-up to https://github.com/go-gitea/gitea/pull/38614

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
bircni
2026-08-14 16:23:30 +02:00
committed by GitHub
parent b6368965fb
commit dbe311197c
15 changed files with 73 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/admin_user_test.go
+19 -6
View File
@@ -14,6 +14,7 @@ import (
"gitea.dev/tests"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestAdminViewUsers(t *testing.T) {
@@ -106,29 +107,41 @@ func TestAdminDeleteUser(t *testing.T) {
func TestAdminImpersonatedUser(t *testing.T) {
defer tests.PrepareTestEnv(t)()
// user2 never signed in yet, only the user themselves should be asked to set a password
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
user2.MustChangePassword = true
require.NoError(t, user_model.UpdateUserCols(t.Context(), user2, "must_change_password"))
session := loginUser(t, "user1")
currentUsername := func(t *testing.T) string {
homeDoc := func(t *testing.T) *HTMLDoc {
t.Helper()
resp := session.MakeRequest(t, NewRequest(t, "GET", "/"), http.StatusOK)
doc := NewHTMLParser(t, resp.Body)
return NewHTMLParser(t, resp.Body)
}
currentUsername := func(doc *HTMLDoc) string {
return doc.Find("[data-signed-in-username]").AttrOr("data-signed-in-username", "")
}
// user1 is admin, can visit admin pages
assert.Equal(t, "user1", currentUsername(t))
assert.Equal(t, "user1", currentUsername(homeDoc(t)))
assert.Equal(t, 0, homeDoc(t).Find(".site-banner-container").Length())
session.MakeRequest(t, NewRequest(t, "GET", "/-/admin/users/2"), http.StatusOK)
// impersonate to user2, user2 can't visit admin pages
session.MakeRequest(t, NewRequest(t, "POST", "/-/admin/users/2/impersonate"), http.StatusOK)
assert.Equal(t, "user2", currentUsername(t))
doc := homeDoc(t)
assert.Equal(t, "user2", currentUsername(doc))
assert.Contains(t, doc.Find(".site-banner-container").Text(), "user2")
session.MakeRequest(t, NewRequest(t, "GET", "/-/admin/users/2"), http.StatusForbidden)
// the impersonating admin must not set the password of the impersonated user
session.MakeRequest(t, NewRequest(t, "GET", "/user/settings/change_password"), http.StatusSeeOther)
// exit impersonation, current user is user1(admin) again
session.MakeRequest(t, NewRequest(t, "GET", "/user/logout"), http.StatusSeeOther)
assert.Equal(t, "user1", currentUsername(t))
assert.Equal(t, "user1", currentUsername(homeDoc(t)))
session.MakeRequest(t, NewRequest(t, "GET", "/-/admin/users/2"), http.StatusOK)
// completely logout
session.MakeRequest(t, NewRequest(t, "GET", "/user/logout"), http.StatusSeeOther)
assert.Equal(t, "", currentUsername(t))
assert.Equal(t, "", currentUsername(homeDoc(t)))
}