Just installed this module on my site to keep all content private. When this module is enabled, I cannot masquerade as other users using the Masquerade module, or the drop down user change functionality of the Admin menu module. Please advise.

Comments

jun’s picture

jun CreditAttribution: jun commented

Same problem here.

afreeman’s picture

afreeman CreditAttribution: afreeman commented

Subscribe.

charos’s picture

charos CreditAttribution: charos commented

Works fine here. Just use the block provided by masquerade module. Other menu (admin,navigation) won't work. This is a problem with masquerade - not by secures site.

dagomar’s picture

dagomar CreditAttribution: dagomar commented

I have this issue duplicated in the masquerade cue: http://drupal.org/node/1286592

I am not sure where it belongs. For me it doesnt work, and I am using the block as per suggestion. Where does this bug belong?

hadsie’s picture

hadsie CreditAttribution: hadsie commented

EDIT: Sorry about this, I confused the securepages and securesite modules :) I'm actually not sure why there would be a conflict with this module as it's not really at all related to SSL is it?

This still exists in the 7.x versions of masquerade and securepages (git). And I believe it's to do with the way that drupal handles cookies in an SSL environment. In my setup admin users are always under SSL, and regular users are only on SSL when they're on forms. I don't believe that cookies are shared between HTTPS and HTTP sessions so when I initiate the masquerade I'm under an HTTPS session and then switch to an HTTP session for the regular user. This means there's no way for masquerade to know that I'm masquerading while I'm on a non HTTPS page.

There are two ways I can see of that will workaround this problem...
1. Make it so that when masquerading the masqueraded user is always using the same protocol (SSL or non-SSL) as when the admin first masqueraded.
2. Allow the admin to choose to either always masquerade as SSL or as non-SSL.

The second option would require a form_alter for the masquerade form to force form submission to the appropriate http or https url (regardless of the current protocol). It would also mean that securepages would need to keep track of the fact that the user is masquerading and remember which protocol to force regardless of the other settings.