Skip to content

Fix admin lockout impersonate mode#51

Merged
skerbis merged 5 commits intomainfrom
fix-admin-lockout-impersonate-mode
Nov 6, 2025
Merged

Fix admin lockout impersonate mode#51
skerbis merged 5 commits intomainfrom
fix-admin-lockout-impersonate-mode

Conversation

@skerbis
Copy link
Member

@skerbis skerbis commented Nov 6, 2025

No description provided.

- Neue Methode checkImpersonateWarning() zeigt Warnung an
- Warnung erscheint wenn Admin im Impersonate-Modus ist und Backend-Wartung aktiv
- Mehrsprachige Unterstützung (DE/EN) hinzugefügt
- Warnung wird über OUTPUT_FILTER eingefügt
- Zeigt JavaScript-Alert beim ersten Seitenladen im Impersonate-Modus
- Zusätzlich permanente Warnung am Seitenanfang
- Verwendet sessionStorage um Alert nur einmal pro Session zu zeigen
- Fallback falls jQuery oder DOM-Elemente nicht verfügbar sind
- Deutlich sichtbarer als vorherige HTML-only Lösung
- Entferne Debug-Code und permanente HTML-Warnung
- Zeigt nur JavaScript-Alert beim ersten Seitenladen
- Korrigiere JavaScript-Escaping für saubere Anzeige ohne "
- Alert wird nur einmal pro Session angezeigt (sessionStorage)
- Einfache und unaufdringliche Lösung
- Entferne geschweifte Anführungszeichen um Benutzername in DE/EN
- Verhindert HTML-Entity " im JavaScript-Alert
- Saubere Darstellung ohne störende Escape-Zeichen
- Text ist jetzt: 'Der Benutzer Max, dessen Identität...'
  statt: 'Der Benutzer "Max", dessen Identität...'
Copilot AI review requested due to automatic review settings November 6, 2025 12:03
@skerbis skerbis merged commit 41dfafe into main Nov 6, 2025
2 checks passed
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a warning system for administrators using the impersonate feature during backend maintenance mode. When an admin impersonates a non-admin user who would normally be blocked by backend maintenance mode, a JavaScript alert is displayed to inform them that they still have access due to their admin privileges.

  • Added language strings for the impersonate warning in English and German
  • Implemented an OUTPUT_FILTER extension point to inject JavaScript warning modal
  • Fixed indentation issues in the PACKAGES_INCLUDED extension point

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File Description
boot.php Added OUTPUT_FILTER extension to display impersonate warning and fixed indentation in PACKAGES_INCLUDED block
lang/en_gb.lang Added English translations for impersonate warning title and message
lang/de_de.lang Added German translations for impersonate warning title and message
lib/Upkeep.php Added blank lines for code formatting

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

if (rex_addon::get('cronjob')->isAvailable() && !rex::isSafeMode()) {
rex_cronjob_manager::registerType('rex_upkeep_ips_cleanup_cronjob');
}
} // URL-Redirects (nur wenn kein Wartungsmodus aktiv war)
Copy link

Copilot AI Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing line break before the comment. The closing brace on line 59 should be on its own line, followed by a blank line before the comment on line 59.

Suggested change
} // URL-Redirects (nur wenn kein Wartungsmodus aktiv war)
}
// URL-Redirects (nur wenn kein Wartungsmodus aktiv war)

Copilot uses AI. Check for mistakes.
rex_extension::register('OUTPUT_FILTER', static function (rex_extension_point $ep) {
// Nur im Backend und nur wenn alle Bedingungen erfüllt sind
$addon = rex_addon::get('upkeep');
if (!rex::isBackend() || !$addon->getConfig('backend_active', false)) {
Copy link

Copilot AI Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant check: the entire extension registration is already wrapped in if (rex::isBackend()) at line 64, making the !rex::isBackend() condition on line 68 always false. Remove this redundant check.

Suggested change
if (!rex::isBackend() || !$addon->getConfig('backend_active', false)) {
if (!$addon->getConfig('backend_active', false)) {

Copilot uses AI. Check for mistakes.
Comment on lines +95 to +96
$titleJs = str_replace(['\\', '"', "'", "\n", "\r"], ['\\\\', '\\"', "\\'", '\\n', '\\r'], $title);
$messageJs = str_replace(['\\', '"', "'", "\n", "\r"], ['\\\\', '\\"', "\\'", '\\n', '\\r'], $message);
Copy link

Copilot AI Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Manual JavaScript escaping is error-prone and may not handle all edge cases. Use json_encode() with JSON_HEX_APOS | JSON_HEX_QUOT flags for safer JavaScript string escaping, or use htmlspecialchars() with ENT_QUOTES if appropriate.

Copilot uses AI. Check for mistakes.
jQuery(document).ready(function($) {
// Modal beim ersten Laden anzeigen
if (!sessionStorage.getItem("upkeep_impersonate_warning_shown")) {
alert("⚠️ ' . $titleJs . '\\n\\n' . $messageJs . '");
Copy link

Copilot AI Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Using native alert() provides a poor user experience. Consider using REDAXO's built-in notification system or a proper modal dialog instead of a browser alert.

Suggested change
alert("⚠️ ' . $titleJs . '\\n\\n' . $messageJs . '");
var $notification = $('<div class="rex-message rex-warning"><div class="rex-message-content"><strong>⚠️ ' . $titleJs . '</strong><br>' . $messageJs . '</div></div>');
$(".rex-page").prepend($notification);

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants