fix: impersonation is now a POST action

Author: azmeuk

CHANGES.rst

@@ -1,3 +1,10 @@
+[0.3.7] - Unreleased
+--------------------
+
+Fixed
+^^^^^
+- User impersonation was a ``GET`` request, thus not covered by the CSRF protection. It is now confirmed with a form, and the ``/impersonate/<user>`` endpoint is removed.
+
 [0.3.6] - 2026-08-04
 --------------------
 

canaille/core/endpoints/account/__init__.py

@@ -801,6 +801,27 @@ def _handle_lock_actions(user, edited_user, action):
         return _handle_profile_settings_edit(user, edited_user)
 
 
+def _handle_impersonate_actions(user, edited_user, action):
+    if not user.can_impersonate_users or edited_user.id == user.id:
+        abort(403)
+
+    if edited_user.locked:
+        abort(403, _("Locked users cannot be impersonated."))
+
+    if action == "impersonate-confirm":
+        return render_template(
+            "core/modals/impersonate-user.html", edited_user=edited_user
+        )
+
+    login_user(edited_user, remember=False)
+    current_app.logger.security(f"User {user.id} impersonated {edited_user.id}")
+    flash(
+        _("Connection successful. Welcome %(user)s", user=edited_user.name),
+        "success",
+    )
+    return redirect(url_for("core.account.index"))
+
+
 @bp.route("/profile/<user:edited_user>/settings", methods=("GET", "POST"))
 @user_needed()
 def profile_settings(user, edited_user):
@@ -828,6 +849,9 @@ def profile_settings(user, edited_user):
     ):
         return _handle_lock_actions(user, edited_user, action)
 
+    if action in ("impersonate-confirm", "impersonate-execute"):
+        return _handle_impersonate_actions(user, edited_user, action)
+
     abort(400, f"bad form action: {action}")
 
 
@@ -886,21 +910,6 @@ def _handle_profile_settings_edit(editor, edited_user):
     )
 
 
-@bp.route("/impersonate/<user:puppet>")
-@user_needed("impersonate_users")
-def impersonate(user, puppet):
-    if puppet.locked:
-        abort(403, _("Locked users cannot be impersonated."))
-
-    login_user(puppet, remember=False)
-    current_app.logger.security(f"User {user.id} impersonated {puppet.id}")
-    flash(
-        _("Connection successful. Welcome %(user)s", user=puppet.name),
-        "success",
-    )
-    return redirect(url_for("core.account.index"))
-
-
 @bp.app_template_filter()
 def photo_url(user, external=False):
     serializer = URLSafeSerializer(current_app.config["SECRET_KEY"], salt="photo")

canaille/templates/core/account/settings.html

@@ -114,9 +114,9 @@ <h2 class="ui center aligned header">
                     {% endif %}
 
                     {% if user.can_impersonate_users and user.identifier != edited_user.identifier and not edited_user.locked %}
-                        <a href="{{ url_for('core.account.impersonate', puppet=edited_user) }}" class="ui right floated basic button" name="action" value="impersonate" id="impersonate" hx-boost="false">
+                        <button type="submit" class="ui right floated basic button confirm" name="action" value="impersonate-confirm" id="impersonate" formnovalidate>
                             {{ _("Impersonate") }}
-                        </a>
+                        </button>
                     {% endif %}
 
                     <button type="submit" class="ui right floated primary button" name="action" value="edit-settings" id="edit-settings">

canaille/templates/core/modals/impersonate-user.html

@@ -0,0 +1,26 @@
+{% extends theme('base.html') %}
+
+{% block content %}
+    <div id="modal-impersonate" class="ui info message">
+        <form method="post" action="{{ request.url }}">
+            <input type="hidden" name="csrf_token" value="{{ request.form.get("csrf_token") }}">
+            <div class="ui icon header">
+                <i class="mask icon"></i>
+                {% trans %}Account impersonation{% endtrans %}
+            </div>
+            <div class="content">
+                <p>
+                    {% trans user_name=(edited_user.formatted_name or edited_user.identifier) %}
+                        Are you sure you want to open a session as {{ user_name }}? Every action you will perform will be attributed to them. Log out to get back to your own session.
+                    {% endtrans %}
+                </p>
+            </div>
+            <div class="ui center aligned container">
+                <div class="ui stackable buttons">
+                    <a class="ui cancel button" href="{{ request.url }}">{% trans %}Cancel{% endtrans %}</a>
+                    <button type="submit" name="action" value="impersonate-execute" class="ui primary approve button">{% trans %}Impersonate{% endtrans %}</button>
+                </div>
+            </div>
+        </form>
+    </div>
+{% endblock %}