Log when a user impersonates another user

Discourse has this great log of all the actions that the admins do (Staff actions).
/{discorse URL}/admin/logs/staff_action_logs

One thing it does not record is when an admin “impersonates” another user. This could be problematic as I want to have moderators and admins to have this ability but I want a log of this action to know when it is happening. To help reduce admin abuse.

6 Likes

Impersonation is limited to “developer” accounts anyway, only the account that installed Discourse can use this feature. A regular admin appointed after install, cannot.

That is my understanding can you confirm @sam?

Admins can impersonate anyone except for other admins
Developers can impersonate anyone
Moderators can not impersonate

We should log this regardless

https://github.com/discourse/discourse/blob/b09ad870980b4ec29a0f3497680eda7778c4a11e/lib/guardian.rb#L126-L139

4 Likes

And we do now :poodle:

https://github.com/discourse/discourse/commit/bb2d53819431ba92d45b20950854dfc8131c858c

2 Likes