A lot of work with django-hijack

[Mogost]

@philippeowagner We should probably discuss the changes outside of Github. I wrote you in KeyBase.
My package on test.pypi https://test.pypi.org/project/django-hijack/

=== (3.0.0) ===

• Drop support for python<3.5
• Drop support for Django<2.2
• Big code refactoring
• CI improvements, automatically pypi deploy
• Added wheel for pypi build

[Mogost]

Here we need updating from the pypi owner.

[philippeowagner]

@Mogost I got your message. I will get in touch ASAP.

[maxmorlocke]

Since conversations are happening off platform, is there anything a community contributor can do to help get this merged? We're using a fork of this fork live in production without issues and would like to help mainline it if possible.

[Mogost]

I've been waiting for a long time for my PR to be reviewed.
It would be advisable to do the same work for the django-hijack-admin package.
(Actually, I don’t understand why django-hijack-admin is not integrated into django-hijack).
I am ready to devote some time to supporting the project. And this is one of the reasons why I automated the release process. Doing this automatically is the easiest way.
But now we need some help from the project maitners. @philippeowagner

[maxmorlocke]

From what I've read, hijack admin exists in a separate package because the default implementation for admin relies on switching to use a HTTP GET for the admin switch user button. That's insecure as it exposes CSRF vulnerabilities. The solution is a really simple hack proposed a long time ago which is to use form actions. This was not accepted into the mainline because of browser compatibility issues. I don't think this is much of a problem in 2020, and frankly would be more concerned about the security implications of the older browser.

I'm happy to help as a contributor/maintainer as well if this project is updated along the lines Alexandr has outlined.

[Mogost]

Any progress here? @philippeowagner

[coveralls]

Coverage decreased (-0.1%) to 96.109% when pulling de89816 on Mogost:fork into 70ebdbe on arteria:master.

[coveralls]

Coverage decreased (-0.1%) to 96.109% when pulling de89816 on Mogost:fork into 70ebdbe on arteria:master.

[Mogost]

@philippeowagner Is there any progress with this?
I'm almost ready to just fork it.

[codingjoe]

@Mogost I think there are still a log of good changes in here. Would you mind rebasing this and maybe extract your changes into separate PRs? If you need anything, let me know. I will close the PR. Just open it, if you prefer to keep your work in a single PR, works for me too.

[Mogost]

@codingjoe I will concentrate more on reviewing at your code for now. In fact, you've already pulled most of my changes into separate Pull Requests.