MarkUsProject/Markus — pull request #1780 by toriverly (2014-09-21 13:35:30+00:00)
Title: Fixes #1722

Issue: #1722

Summary: Admin "Login as" feature can't be undone

After logging in as a student/TA, the option to switch roles was not available.
Switching to an admin role was not possible (i.e. if the switch icon were
visible, admins could not return to their normal role). The session[:real_uid]
would track the previous session[:uid] after each switch instead of retaining
the original session[:uid].

We needed to make it possible for all sessions with a session[:real_uid]
associated with an admin account to (1) see the switch roles icon, (2) switch
back to their own role, and (3) switch directly from one student/TA role to
another. However, (4) an admin should not be able to switch to the role of
another admin. Additionally, (5) session[:real_uid] needed to retain the
original session[:uid] in order to keep track of the user's real role, and (6)
session[:real_uid] needed to be reset when the admin dropped back to their
normal role (the non-nil value of session[:real_uid] is used in some places to
detect whether the user has assumed the role of another user).

Fix:
(1)
_header.html.erb
Added check for the user associated with session[:real_uid] being admin
(used to only check if current_user is admin) where we decide whether or not to
show the switch roles icon in the header view.

session_handler.rb
Added a new authorization function in SessionHandler to check if session[:uid]
or session[:real_uid] is associated with Admin

main_controller.rb
use the new authorization function for login_as

(2/4)
main_controller.rb
Added check for the found_user being different than the real_user where we
check against switching to an admin role. We now generate an error only if the
found_user and real_user are different. E.g. admin1, who has switched to the role
of student1, can't switch roles to admin2 but can switch back to admin1.

(3/5)
main_controller.rb
Only set session[:real_uid] to session[:uid] if it hasn't been set
already. Allows session to keep track of original admin role when admin (as
student1) switches roles to student2.

(6)
main_controller.rb
Set session[:real_uid] to nil if found_user and real_user are the same
(dropping back to normal role)

Test:

None just yet...