Repository: saleor/saleor

Issue:
Remove or block impersonate's "list" and "search" urls
Saleor uses the [django-impersonate](https://bitbucket.org/petersanchez/django-impersonate/overview) for client impersonation feature. While working on #1549 I've found out that in addition to two views that we are using (start and stop impersonating the user), the library brings additional two views that we don't really want to support:

https://demo.getsaleor.com/impersonate/list/
https://demo.getsaleor.com/impersonate/search/?q=admin (note: this one 500's on link)

Ideally, library would've provided us with a settings to disable those views, but this isn't the case.

So its worth asking ourselves what harm is there in keeping those views around, and if we really want to get rid of those two views, how would we go about it?

Looking at the [imersonate.urls](https://bitbucket.org/petersanchez/django-impersonate/src/f898c697b2bd9945187f8667d680e6d10d06dc33/impersonate/urls.py?at=default&fileviewer=file-view-default), it may be as simple as updating our `urls.py` to explictly define `impersonate-start` and `impersonate-stop`, or perhaps we should open the issue upstream and see what library's author thinks about it?
  


Discussion:
Let's just explicitly link to views we need.

Resolving patch:
diff --git a/saleor/urls.py b/saleor/urls.py
--- a/saleor/urls.py
+++ b/saleor/urls.py
@@ -5,6 +5,7 @@
 from django.contrib.staticfiles.views import serve
 from django.views.i18n import JavaScriptCatalog
 from graphene_django.views import GraphQLView
+from impersonate.views import impersonate, stop_impersonate
 
 from .cart.urls import urlpatterns as cart_urls
 from .checkout.urls import urlpatterns as checkout_urls
@@ -27,7 +28,8 @@
     url(r'^dashboard/',
         include((dashboard_urls, 'dashboard'), namespace='dashboard')),
     url(r'^graphql', GraphQLView.as_view(graphiql=settings.DEBUG)),
-    url(r'^impersonate/', include('impersonate.urls')),
+    url(r'^impersonate/stop/$', stop_impersonate, name='impersonate-stop'),
+    url(r'^impersonate/(?P<uid>\d+)/$', impersonate, name='impersonate-start'),
     url(r'^jsi18n/$', JavaScriptCatalog.as_view(), name='javascript-catalog'),
     url(r'^order/', include((order_urls, 'order'), namespace='order')),
     url(r'^products/',


Test patch:
diff --git a/tests/test_impersonation.py b/tests/test_impersonation.py
--- a/tests/test_impersonation.py
+++ b/tests/test_impersonation.py
@@ -1,4 +1,6 @@
+import pytest
 from django.core.urlresolvers import reverse
+from django.urls.exceptions import NoReverseMatch
 
 from saleor.userprofile.models import User
 
@@ -14,3 +16,19 @@ def test_staff_with_permission_can_impersonate(
     assert response.context['user'] == customer_user
     assert response.context['user'].is_impersonate
     assert response.context['request'].impersonator == staff_user
+
+    response = staff_client.get(reverse('impersonate-stop'), follow=True)
+    assert response.context['user'] == staff_user
+    assert response.context['user'].is_impersonate is False
+
+
+def test_impersonate_list_search_urls_are_disabled():
+    with pytest.raises(NoReverseMatch):
+        reverse('impersonate-list')
+    with pytest.raises(NoReverseMatch):
+        reverse('impersonate-search')
+
+
+def test_impersonate_start_url_uid_arg_is_number():
+    with pytest.raises(NoReverseMatch):
+        reverse('impersonate', args=['string'])