From 5fa37297024dd6f024299c4d523573754b64c1f5 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Sat, 19 Sep 2020 22:49:40 +0200 Subject: [PATCH] audit: fix fields for events from impersonation being swapped --- passbook/audit/models.py | 8 ++++++-- passbook/core/views/impersonate.py | 6 ++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/passbook/audit/models.py b/passbook/audit/models.py index f8e5d0870..125bf9162 100644 --- a/passbook/audit/models.py +++ b/passbook/audit/models.py @@ -15,7 +15,10 @@ from django.views.debug import SafeExceptionReporterFilter from guardian.shortcuts import get_anonymous_user from structlog import get_logger -from passbook.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER +from passbook.core.middleware import ( + SESSION_IMPERSONATE_ORIGINAL_USER, + SESSION_IMPERSONATE_USER, +) from passbook.lib.utils.http import get_client_ip LOGGER = get_logger() @@ -148,8 +151,9 @@ class Event(models.Model): # Check if we're currently impersonating, and add that user if hasattr(request, "session"): if SESSION_IMPERSONATE_ORIGINAL_USER in request.session: + self.user = request.session[SESSION_IMPERSONATE_ORIGINAL_USER] self.context["on_behalf_of"] = model_to_dict( - request.session[SESSION_IMPERSONATE_ORIGINAL_USER] + request.session[SESSION_IMPERSONATE_USER] ) # User 255.255.255.255 as fallback if IP cannot be determined self.client_ip = get_client_ip(request) or "255.255.255.255" diff --git a/passbook/core/views/impersonate.py b/passbook/core/views/impersonate.py index 49fcc2ab9..a2e9dd09f 100644 --- a/passbook/core/views/impersonate.py +++ b/passbook/core/views/impersonate.py @@ -31,7 +31,7 @@ class ImpersonateInitView(View): request.session[SESSION_IMPERSONATE_ORIGINAL_USER] = request.user request.session[SESSION_IMPERSONATE_USER] = user_to_be - Event.new(EventAction.IMPERSONATION_STARTED).from_http(request) + Event.new(EventAction.IMPERSONATION_STARTED).from_http(request, user_to_be) return redirect("passbook_core:overview") @@ -48,9 +48,11 @@ class ImpersonateEndView(View): LOGGER.debug("Can't end impersonation", user=request.user) return redirect("passbook_core:overview") + original_user = request.session[SESSION_IMPERSONATE_ORIGINAL_USER] + del request.session[SESSION_IMPERSONATE_USER] del request.session[SESSION_IMPERSONATE_ORIGINAL_USER] - Event.new(EventAction.IMPERSONATION_ENDED).from_http(request) + Event.new(EventAction.IMPERSONATION_ENDED).from_http(request, original_user) return redirect("passbook_core:overview")