QA (public) » openQA Project (public)

https://progress.opensuse.org/issues/68287 #68287 was rejected with the note that this is something we can fix.

So I would increase the priority here and handle it in the next estimating.

dheidler wrote:

https://github.com/os-autoinst/openQA/pull/4151

Did you test that this works in production? I just tried to visit https://openqa.opensuse.org/admin/users which prompted me to login and then sent me back to the homepage.

It works when you are on a non-admin page before you login.
It seems that the automated redirect to login that happens when accessing an admin page without being already logged in is not working.
I will have a look.

The problem is that if an admin-only or operator-only page is accessed without a session the user is redirected to /login:

sub ensure_operator {
    my ($self) = @_;
    $self->redirect_to('login')                       and return undef unless $self->current_user;
    $self->render(text => "Forbidden", status => 403) and return undef unless $self->is_operator;
    return 1 if $self->req->method eq 'GET' || $self->valid_csrf;
    $self->render(text => 'Bad CSRF token!', status => 403);
    return undef;
}

sub ensure_admin {
    my ($self) = @_;
    $self->redirect_to('login')                       and return undef unless $self->current_user;
    $self->render(text => "Forbidden", status => 403) and return undef unless $self->is_admin;
    return 1 if $self->req->method eq 'GET' || $self->valid_csrf;
    $self->render(text => 'Bad CSRF token!', status => 403);
    return undef;
}

When a 302-redirect is performed, the browser is sending the original referrer (the page that the user was on before he clicked the link pointing to the admin page) and not the admin page itself, which initiated the redirect.