darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-02 17:48:50 -04:00
Code Issues Packages Projects Releases Wiki Activity

add option to suppress platform admin temporarily

Browse Source 
so that platform admins (us) can view pages as regular users do easily.
Simply adds a flag in the session cookie that overrides the actual
platform admin flag on the user model if set. This way it's safe, since
this only downgrades existing functionality, so if someone managed to
alter it they could only get less permissions, not more.

You can change this value from the user profile page if either:

* you're a platform admin
* the flag is set (to any value) on the cookie.

This slightly weird check means that we don't check the underlying
`user._platform_admin` flag anywhere in the code, even when toggling
the suppression.
This commit is contained in:
Leo Hemsted
2019-06-13 19:00:17 +01:00
parent c7325576d6
commit 7b02cb72c6
7 changed files with 147 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/templates/views/user-profile.html
View File

@@ -45,6 +45,14 @@
{{ edit_field('Change', url_for('.user_profile_password')) }}
{% endcall %}
{% if current_user.platform_admin or session.get('suppress_platform_admin') %}
{% call row() %}
{{ text_field('Suppress Platform Admin') }}
{{ text_field('On' if session.get('suppress_platform_admin') else 'Off') }}
{{ edit_field('Change', url_for('.user_profile_suppress_platform_admin')) }}
{% endcall %}
{% endif %}
{% endcall %}
</div>

27
app/templates/views/user-profile/suppress-platform-admin.html Normal file
View File

@@ -0,0 +1,27 @@
{% extends "withoutnav_template.html" %}
{% from "components/form.html" import form_wrapper %}
{% from "components/page-footer.html" import page_footer %}
{% from "components/page-header.html" import page_header %}
{% from "components/radios.html" import radios %}
{% block per_page_title %}
Suppress platform admin view
{% endblock %}
{% block maincolumn_content %}
<div class="grid-row">
<div class="column-five-sixths">
{{ page_header(
'Suppress platform admin',
back_link=url_for('.user_profile')
) }}
{% call form_wrapper() %}
{{ radios(form.enabled) }}
{{ page_footer('Save') }}
{% endcall %}
</div>
</div>
{% endblock %}