require superuser status to impersonate others (#241)

Co-authored-by: Jake Rosenberg <[email protected]>
TACC · Jun 1, 2023 · a133799 · a133799
1 parent d977726
commit a133799
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/apps/tup-cms/src/apps/portal/views.py b/apps/tup-cms/src/apps/portal/views.py
@@ -34,7 +34,7 @@ def LogoutView(request):
 
 def ImpersonateView(request):
     resp = HttpResponseRedirect("/portal/dashboard")
-    if not request.user.is_staff:
+    if not request.user.is_superuser:
         return resp
 
     headers = {"x-tup-token": settings.TUP_SERVICES_ADMIN_JWT}

diff --git a/apps/tup-cms/src/apps/portal_nav/templates/portal_nav/nav_portal.raw.html b/apps/tup-cms/src/apps/portal_nav/templates/portal_nav/nav_portal.raw.html
@@ -39,7 +39,7 @@
     <a class="dropdown-item" href="/portal/account">
       <i class="icon icon-user"></i> Manage Account
     </a>
-    {% if user.is_staff %}
+    {% if user.is_superuser %}
     <a class="dropdown-item" href="/portal/impersonation">
       <i class="icon icon-user"></i> Impersonate User
     </a>