fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-02 01:52:10 +09:00
Code Issues Projects Releases Packages Wiki Activity

Add admin login-as feature to member admin list

Browse source 
Add procMemberAdminLoginAs action that allows super admins to
login as a specific non-admin member from the member admin list page.
Includes CSRF protection, admin-only access check, and prevention of
logging in as another admin user.

Co-authored-by: Lastorder-DC <18280396+Lastorder-DC@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-03-02 04:10:30 +00:00
parent 0a5bbef276
commit d6486a0415
5 changed files with 67 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

40
modules/member/member.admin.controller.php
View file

@ -1802,6 +1802,46 @@ class MemberAdminController extends Member
return new BaseObject();
}
/**
* Login as a specific member (admin only)
* @return void|BaseObject
*/
function procMemberAdminLoginAs()
{
// Check admin permission and CSRF token
$logged_info = Context::get('logged_info');
if(!$logged_info || $logged_info->is_admin !== 'Y' || !Rhymix\Framework\Security::checkCSRF())
{
throw new Rhymix\Framework\Exceptions\InvalidRequest;
}
$member_srl = Context::get('member_srl');
if(!$member_srl)
{
throw new Rhymix\Framework\Exceptions\InvalidRequest;
}
// Get target member info
$member_info = MemberModel::getMemberInfoByMemberSrl($member_srl);
if(!$member_info || !$member_info->member_srl)
{
throw new Rhymix\Framework\Exceptions\InvalidRequest;
}
// Do not allow login as another admin
if($member_info->is_admin === 'Y')
{
throw new Rhymix\Framework\Exceptions\NotPermitted;
}
// Perform login as the target member
Rhymix\Framework\Session::login($member_info->member_srl);
$oMemberController = getController('member');
$oMemberController->setSessionInfo();
$this->setRedirectUrl(getNotEncodedUrl(''));
}
}
/* End of file member.admin.controller.php */
/* Location: ./modules/member/member.admin.controller.php */