django-hijack/django-hijack-admin

Django admin site integration for Django Hijack

Django Hijack

With Django Hijack, admins can log in and work on behalf of other users without having to know their credentials.

Docs

Docs are available on Read the Docs http://django-hijack.readthedocs.org/en/stable/, both for v2.x and v3.x.

Versions

There are two versions available: v2.x and v3.x.

v3.x provides a security first design, easy integration, customisation, out-of-the-box Django admin support and dark-mode. It is a complete rewrite and all former APIs are broken.

Testimonials

I am using django-hijack on a project with hundreds of users, wonderful tool for support. Thank you!

-- benzinonapoloni on reddit

This is a super useful tool. I have a site where I occasionally impersonating users to help troubleshoot their issues. This is a huge time saver.

-- orangishyellow on reddit

... one of our standard apps to install now.

-- thundersnow on reddit

Love django-hijack

-- bmihelac on Twitter

django-hijack-admin's Issues

missing changelog for 2.1.5

If it's not too much trouble, can you write up a quick changelog for 2.1.5?

Unable to install with last setuptools >= 59.*

Since last setuptools update, it's not possible to install this package from pypi

pip install setuptools==59.* -U
pip install django-hijack-admin

results with:

  ERROR: Command errored out with exit status 1:
   command: /venv/bin/python3.8 -c 'import io, os, sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-iqo9p33i/django-hijack-admin_a859a87cbd2f4200962a3694363865ee/setup.py'"'"'; __file__='"'"'/tmp/pip-install-iqo9p33i/django-hijack-admin_a859a87cbd2f4200962a3694363865ee/setup.py'"'"';f = getattr(tokenize, '"'"'open'"'"', open)(__file__) if os.path.exists(__file__) else io.StringIO('"'"'from setuptools import setup; setup()'"'"');code = f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' egg_info --egg-base /tmp/pip-pip-egg-info-zmkhj6_1
       cwd: /tmp/pip-install-iqo9p33i/django-hijack-admin_a859a87cbd2f4200962a3694363865ee/
  Complete output (26 lines):
  running egg_info
  creating /tmp/pip-pip-egg-info-zmkhj6_1/django_hijack_admin.egg-info
  writing /tmp/pip-pip-egg-info-zmkhj6_1/django_hijack_admin.egg-info/PKG-INFO
  Traceback (most recent call last):
    File "<string>", line 1, in <module>
    File "/tmp/pip-install-iqo9p33i/django-hijack-admin_a859a87cbd2f4200962a3694363865ee/setup.py", line 44, in <module>
      setup(name="django-hijack-admin",
    File "/venv/lib/python3.8/site-packages/setuptools/__init__.py", line 153, in setup
      return distutils.core.setup(**attrs)
    File "/usr/lib/python3.8/distutils/core.py", line 148, in setup
      dist.run_commands()
    File "/usr/lib/python3.8/distutils/dist.py", line 966, in run_commands
      self.run_command(cmd)
    File "/usr/lib/python3.8/distutils/dist.py", line 985, in run_command
      cmd_obj.run()
    File "/venv/lib/python3.8/site-packages/setuptools/command/egg_info.py", line 292, in run
      writer(self, ep.name, os.path.join(self.egg_info, ep.name))
    File "/venv/lib/python3.8/site-packages/setuptools/command/egg_info.py", line 656, in write_pkg_info
      metadata.write_pkg_info(cmd.egg_info)
    File "/usr/lib/python3.8/distutils/dist.py", line 1117, in write_pkg_info
      self.write_pkg_file(pkg_info)
    File "/venv/lib/python3.8/site-packages/setuptools/dist.py", line 167, in write_pkg_file
      write_field('Summary', single_line(self.get_description()))
    File "/venv/lib/python3.8/site-packages/setuptools/dist.py", line 151, in single_line
      raise ValueError('Newlines are not allowed')
  ValueError: Newlines are not allowed
  ----------------------------------------
WARNING: Discarding https://files.pythonhosted.org/packages/32/24/1dc0728d7de4a9cfde85bddccaca7cc789677de8a2958e78a5484dce89ce/django-hijack-admin-2.1.10.tar.gz#sha256=330f9be331ada831248c9cee5a21202aea70fb9911b443249ce4c28d57d9e2e3 (from https://pypi.org/simple/django-hijack-admin/). Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.
ERROR: Could not find a version that satisfies the requirement django-hijack-admin==2.1.10 (from versions: 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10)
ERROR: No matching distribution found for django-hijack-admin==2.1.10

No problem with setuptools 58.*

Tested with python 3.8

Django 2.2 Support

Test are not run on Django 2.2

Has anyone successfully used this with Django 2.2?

django-hijack 3.0.0 is not compatible with latest release tag (2.1.10)

While integrating it with Django==3.2, I started to get error because the settings files have been remove from django and put in conf.py

Traceback (most recent call last):

  File "/src/manage.py", line 19, in <module>

    execute_from_command_line(sys.argv)

  File "/home/mitodl/.local/lib/python3.9/site-packages/django/core/management/__init__.py", line 419, in execute_from_command_line

    utility.execute()

  File "/home/mitodl/.local/lib/python3.9/site-packages/django/core/management/__init__.py", line 395, in execute

    django.setup()

  File "/home/mitodl/.local/lib/python3.9/site-packages/django/__init__.py", line 24, in setup

    apps.populate(settings.INSTALLED_APPS)

  File "/home/mitodl/.local/lib/python3.9/site-packages/django/apps/registry.py", line 122, in populate

    app_config.ready()

  File "/home/mitodl/.local/lib/python3.9/site-packages/django/contrib/admin/apps.py", line 27, in ready

    self.module.autodiscover()

  File "/home/mitodl/.local/lib/python3.9/site-packages/django/contrib/admin/__init__.py", line 24, in autodiscover

    autodiscover_modules('admin', register_to=site)

  File "/home/mitodl/.local/lib/python3.9/site-packages/django/utils/module_loading.py", line 47, in autodiscover_modules

    import_module('%s.%s' % (app_config.name, module_to_search))

  File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in import_module

    return _bootstrap._gcd_import(name[level:], package, level)

  File "<frozen importlib._bootstrap>", line 1030, in _gcd_import

  File "<frozen importlib._bootstrap>", line 1007, in _find_and_load

  File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked

  File "<frozen importlib._bootstrap>", line 680, in _load_unlocked

  File "<frozen importlib._bootstrap_external>", line 850, in exec_module

  File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed

  File "/src/users/admin.py", line 5, in <module>

    from hijack_admin.admin import HijackUserAdminMixin

  File "/usr/local/lib/python3.9/site-packages/hijack_admin/admin.py", line 9, in <module>

    from hijack import settings as hijack_settings

ImportError: cannot import name 'settings' from 'hijack' (/home/mitodl/.local/lib/python3.9/site-packages/hijack/__init__.py)

Recommend archiving this repo or adding note

Since django-hijack now has admin integration built-in, and because this package is incompatible with django-hijack, recommend either archiving this repo or adding a note to use the latest version of django-hijack and to not use this package.

Problem with new Django release

Could not find a version that matches Django<1.12,==2.0,>=1.2,>=1.3,>=1.4,>=1.5,>=1.8

Reverse for 'login_with_id' with arguments '(30,)' and keyword arguments '{}' not found. 0 pattern(s) tried: []

I'm currently using HijackUserAdminMixin and I have an interesting error, see the stacktrace. The following are the fixes I found:

Either, using url(r'^hijack/', include('hijack.urls')), instead of url(r'^hijack/', include('hijack.urls', namespace='hijack')) inside my urls.py module.

Or updating the hijack_field function inside HijackUserAdminMixin mixin like this:

19     def hijack_field(self, obj):                                                                                        
20         hijack_attributes = hijack_settings.HIJACK_URL_ALLOWED_ATTRIBUTES                                               
21                                                                                                                         
22         if 'user_id' in hijack_attributes:                                                                              
23             hijack_url = reverse('hijack:login_with_id', args=(obj.pk, ))                                               
24         elif 'email' in hijack_attributes:                                                                              
25             hijack_url = reverse('hijack:login_with_email', args=(obj.email, ))                                         
26         else:                                                                                                           
27             hijack_url = reverse('hijack:login_with_username', args=(obj.username, ))                                   
28                                                                                                                         
29         button_template = get_template(hijack_admin_settings.HIJACK_BUTTON_TEMPLATE)                                    
30         button_context = {                                                                                              
31             'hijack_url': hijack_url,                                                                                   
32             'username': str(obj),                                                                                       
33         }                                                                                                               
34         if VERSION < (1, 8):                                                                                            
35             button_context = Context(button_context)                                                                    
36                                                                                                                         
37         return button_template.render(button_context) 

Let me know if there is something I'm doing wrong.

Thanks a lot.

Warning always appears when using custom user model

https://github.com/arteria/django-hijack-admin/blob/e0773ff37777badfd35cf2d6ce09dfd5e46e536d/hijack_admin/checks.py#L23-L34

This warning seems to unconditionally appear when using a custom user model, even if one has the HijackUserAdminMixin mixed into their custom UserAdmin.

WARNINGS:
user.User: (hijack_admin.W001) django-hijack-admin does not work out the box with a custom user model.
    HINT: Please mix HijackUserAdminMixin into your custom UserAdmin.

Django Hijack Admin is now part of Django Hijack, consider updating the GitHub page to reflect this..

As per an issue in Django Hijack, the admin portion has now been rolled into the main package....

DHA is now integrated into django-hijack package. https://github.com/django-hijack/django-hijack/blob/master/docs/index.md#django-admin-integration

So this is a bit confusing.... Would be a good idea to update DJA's GitHub page to point this out?

hijack_admin.W001 warning

If you need a custom user admin class and a custom admin site the documentation advice to declare HIJACK_USER_ADMIN_CLASS_NAME in setting.py. But it does not allow to use a custom class declared as a fully qualified string as its value is tested with issubclass which does not support string as its first parameter.

Importing a custom admin class in settings.py is not convenient.

Is there a way to use a custom admin class in a custom admin without being warned ?

django-hijack-admin should be part of django-hijack

I find this package redundant
cc: @codingjoe what do you think?

Django 4 compatibility

It appears that django-hijack-admin uses features that have been deprecated in Django 4:

ModuleNotFoundError: No module named 'django.conf.urls.defaults'

I believe this is a result of importing django-compat, which may not be compatible (or necessary) with Django 4.

[bug] Duplicates hijacked session after click on the same user

Hello!

I found interesting bug. If I click hijack button in Django admin panel (for example, [email protected]) and return back and click the same button — hijacked session for this user was duplicates!

And I need to click Release [email protected] twice (or more, equal to click hijack [email protected] in admin panel).

Would be great to fix this bug 👍
My idea is simply hide hijack user button in admin panel, if this user is already hijacked. And, maybe, place small badge like Already hijacked for more understanding.

Thanks, btw, awesome library!

Don't show button for non-active users

Right now all users (active or not) have the hijack button. If you click the button for an inactive user, it will hijack them but you get 'AnonymousUser'. And then you are unable to release the hijack.

The table should only show buttons for active users.

Why does this need a GET request and open up the app to CSRF attacks?

I'm kinda curious why this was an acceptable choice?

How do we use django-hijack without this?

(I read django-hijack/django-hijack#84)

django.utils.translation.ugettext_lazy() is deprecated in Django 3.0

A future version will drop support for ugettext_lazy() in favor of gettext_lazy(). I don't think this presents any compatibility issues, as gettext_lazy() has been around since at least version 1.8, and I believe they're just aliases of one another.

Deprecation announcement in release notes.

Any other considerations I'm not aware of? I may try forking and testing if I have time, and submitting a pull request if everything looks good.

Problem with a custom user model with a custom `USERNAME_FIELD`

I have custom user model with USERNAME_FIELD = 'email'

module requires User.username field which doesn't exist

please adapt the module for the custom user name field

HijackUserAdminMixin should live in a separate file

Anyone who has existing customizations will want to avoid the unregister/register code and use the mixin on it's own. However - this currently isn't possible as HijackUserAdminMixin is in the same module. I'd suggest moving it to a module called something like admin_mixins.py and importing it from there.

(That does raise the question of why the non-mixin version is needed at all. In theory - appending to list_display should be fairly safe - it's the register/unregister that could cause problems)

UserWarning: User is not registered in the default admin. Please integrate hijack into your user admin manually.

how to get rid of that?

I do not use hijack in the Django admin but in my custom forms

Could this depend on django-hijack>=2.1.2?

Currently, in setup.py, one of the requirements is django-hijack==2.1.2. However, the latest version of django-hijack is 2.1.3.

Could the install_requires of setup.py be more accepting of newer versions of django-hijack?

Some people pin specific versions in requirements.txt, and put the allowed version ranges in install_requires, but that's up to you.

Deprecated

Please use https://github.com/django-hijack/django-hijack v3+ with integrated django-hijack-admin functionality.

User-admin check 'hijack_admin.W001' incorrectly assumes default admin site

users.User: (hijack_admin.W001) django-hijack-admin does not work out the box with a custom user model.
        HINT: Please mix HijackUserAdminMixin into your custom UserAdmin.

It looks like this pulls the check from the global admin site, but doesn't notice we're using an overriden site.

I tired overriding the global site but is is too late, checks already ran.

from django.contrib import admin

class CustomAdminSite(admin.AdminSite):
    ...

# set the global site
admin.site = CustomAdminSite()

The warning is easily silenced but FYI.