After installing Drupal 8.1.1 using the minimal install profile, installing Masquerade and placing the User account menu in the left menu block; the Unmasquerade link shows to User 1. If you masquerade as any user and then log out, all normal users will see the unmasquerade link in the User account menu, which they should not. This link points them to a Access Denied page.
If you clear all cache and rebuild routes, logging in as any user other than User 1, the Unmasquerade link does not show. However, if you log back in as User 1, and masquerade as any user, the unmasquerade link will not show up forcing you to logout, instead of using the Unmasquerade link.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | masquerade-show_unmasquerade_link.patch | 572 bytes | sheanhoxie |
Comments
Comment #2
sheanhoxieComment #3
andypostThis change is debatable, it was changed few times - imo we should use session service all over code
Comment #4
andypostComment #5
sheanhoxieI completely agree with using service, however, the code uses session all over the place so I just stuck to the most commonly used practice in masquerade. The service being used now, will always return false under my tests.
Comment #6
andypostSo this require just to skim and replace all usage to unify storage of flag
Comment #7
mr.baileysRegarding #3, there is a needs review patch to switch to using the session service everywhere #2688650: Switch from using $_SESSION to using the Symfony Session.
This patch/issue probably needs test coverage?
Comment #8
mr.baileysActually, I think this issue has already been resolved in the -dev branch by #2448699: Implement caching for the masquerade block and links with a 'masquerade' cache context, which included the change made in the patch here (although the getContext() function should return "1"/"0" rather than true/false, since the result is cast to string as part of the cache identifier, and casting false to string yields an empty string)
@sheanhoxie: can you confirm that you can no longer reproduce this with the 8.x-2.x-dev?
Comment #9
andypostYep, #8 is right! So we need to cleanup non-service usages and fix context (maybe reuse core's one)
NW for context at least
Comment #10
andypostThe session usage should be fixed in related #2688650: Switch from using $_SESSION to using the Symfony Session
Comment #11
stephen ollmanPatch worked for me after clearing cache and logging off and back on again with account (admin) that could access the Masquerade functionality.
Although the 'Unmasquerade' link still shows for the admin account in the user menu block.
Comment #12
sheanhoxie@mr.baileys , using the latest release 8.x-2.x I cannot reproduce this issue. Thanks!
Comment #13
sheanhoxieThe caching aspect of this ticket no longer seems to be around in the latest 8.x-2.x release