Repository: goauthentik/authentik

Issue:
Self impersonation possible
**Describe the bug**
I can impersonate myself.

**To Reproduce**
Steps to reproduce the behavior:

1. Open admin interface
2. Go to users (directory > users)
3. Search for your username (same as in active session)
4. Impersonate button visible

**Expected behavior**
I dont think self impersonation does make any sense.

**Version and Deployment:**

-   authentik version: 2023.8.3
-   Deployment: helm


Discussion:

Resolving patch:
diff --git a/authentik/core/api/users.py b/authentik/core/api/users.py
--- a/authentik/core/api/users.py
+++ b/authentik/core/api/users.py
@@ -616,8 +616,10 @@ def impersonate(self, request: Request, pk: int) -> Response:
         if not request.user.has_perm("impersonate"):
             LOGGER.debug("User attempted to impersonate without permissions", user=request.user)
             return Response(status=401)
-
         user_to_be = self.get_object()
+        if user_to_be.pk == self.request.user.pk:
+            LOGGER.debug("User attempted to impersonate themselves", user=request.user)
+            return Response(status=401)
 
         request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER] = request.user
         request.session[SESSION_KEY_IMPERSONATE_USER] = user_to_be


Test patch:
diff --git a/authentik/core/tests/test_impersonation.py b/authentik/core/tests/test_impersonation.py
--- a/authentik/core/tests/test_impersonation.py
+++ b/authentik/core/tests/test_impersonation.py
@@ -6,6 +6,7 @@
 
 from authentik.core.models import User
 from authentik.core.tests.utils import create_test_admin_user
+from authentik.lib.config import CONFIG
 
 
 class TestImpersonation(APITestCase):
@@ -46,12 +47,42 @@ def test_impersonate_denied(self):
         """test impersonation without permissions"""
         self.client.force_login(self.other_user)
 
-        self.client.get(reverse("authentik_api:user-impersonate", kwargs={"pk": self.user.pk}))
+        response = self.client.post(
+            reverse("authentik_api:user-impersonate", kwargs={"pk": self.user.pk})
+        )
+        self.assertEqual(response.status_code, 403)
 
         response = self.client.get(reverse("authentik_api:user-me"))
         response_body = loads(response.content.decode())
         self.assertEqual(response_body["user"]["username"], self.other_user.username)
 
+    @CONFIG.patch("impersonation", False)
+    def test_impersonate_disabled(self):
+        """test impersonation that is disabled"""
+        self.client.force_login(self.user)
+
+        response = self.client.post(
+            reverse("authentik_api:user-impersonate", kwargs={"pk": self.other_user.pk})
+        )
+        self.assertEqual(response.status_code, 401)
+
+        response = self.client.get(reverse("authentik_api:user-me"))
+        response_body = loads(response.content.decode())
+        self.assertEqual(response_body["user"]["username"], self.user.username)
+
+    def test_impersonate_self(self):
+        """test impersonation that user can't impersonate themselves"""
+        self.client.force_login(self.user)
+
+        response = self.client.post(
+            reverse("authentik_api:user-impersonate", kwargs={"pk": self.user.pk})
+        )
+        self.assertEqual(response.status_code, 401)
+
+        response = self.client.get(reverse("authentik_api:user-me"))
+        response_body = loads(response.content.decode())
+        self.assertEqual(response_body["user"]["username"], self.user.username)
+
     def test_un_impersonate_empty(self):
         """test un-impersonation without impersonating first"""
         self.client.force_login(self.other_user)