It seems that the module code doesn't show the masquerade block in case where the user don't have "masquerade as user" permission but have defined "masquerade as" list of users in profile. The following IF statement in module's code doesn't refer to above mentioned case

      if (isset($_SESSION['masquerading']) || (user_access('masquerade as user') || user_access('masquerade as admin'))) {
        $block['subject'] = t('Masquerade');
        $block['content'] = drupal_get_form('masquerade_block_1');
      }
CommentFileSizeAuthor
#4 1666706-masq-access-4.patch666 bytesphiscock
#1 1666706-masq-access-1.patch677 bytesandypost

Comments

andypost’s picture

andypost
he/him
Primary language Russian
commented
Version: 7.x-1.0-rc4 » 7.x-1.x-dev
Status: Active » Needs review
StatusFileSize
new 1666706-masq-access-1.patch677 bytes

Sure, we should not show this settings on user profile while he has no access

rosell.dk’s picture

rosell.dk commented

It seems the answer and the supplied patch are due to two misunderstandings?

As the module works now (7.x-1.0-rc4), a user A can masquerade as another user B, EVEN if user A does not have the "masquerade as user" permission. If user A has user B listed as users he is allowed to masquerade as, then user A is able to masquerade as user B, regardless. I'm not sure if this is intended behaviour, but this is how it works

One would expect that the block displays when a user is able to masquerade as another user. As it is now, it will however not display in the scenario above. To correct this will require a change in the code that was quoted in the issue summary.

The supplied patch however doesn't deal with the block view, but with the user form. This is what seems to be the one misunderstanding. The other misunderstanding is that the access to this form needs to be changed. I think it makes perfectly sense that this form requires the "administer masquerade" permission. - it is a place where masquerade rights are administrated individually on users.

Igal’s picture

Igal commented

@rosell.dk,
your description of the problem is correct. I just changed 

if (isset($_SESSION['masquerading']) || (user_access('masquerade as user') || user_access('masquerade as admin'))) {
        $block['subject'] = t('Masquerade');
        $block['content'] = drupal_get_form('masquerade_block_1');
 }

with

if (isset($_SESSION['masquerading']) || (user_access('masquerade as user') || user_access('masquerade as admin')) || masquerade_menu_access('user')) {
        $block['subject'] = t('Masquerade');
        $block['content'] = drupal_get_form('masquerade_block_1');
}
phiscock’s picture

phiscock commented
StatusFileSize
new 1666706-masq-access-4.patch666 bytes

Thank you @rosell.dk. This worked well for me in displaying the block with just a limited list of users that a person is allowed to masquerade as. I've made a patch against the latest dev version that implements your solution in the hope that this change might be committed.

Paul

ressa’s picture

ressa
he/him
commented
Issue summary: View changes
Status: Needs review » Closed (outdated)

Thanks for working on this. In an attempt to help the maintainers, I am going through some of the Drupal 7 issues, and closing them, since Drupal 7 is EOL.

Maintainers should grant credit for the great work to the relevant users, even if the patch did not get committed: https://www.drupal.org/docs/develop/issues/issue-procedures-and-etiquett....

Since Drupal 7 is EOL, we can probably close this issue, but feel free to re-open if this is still relevant, and we should consider adding this to the Drupal 11 version?

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.