Bug: "Login as" link ignores site/language routing, losing GET parameters on multi-language sites
Environment
- femanager: 13.3.2 (confirmed still present in 13.3.3 – unchanged template)
- TYPO3: 13.4.31
- Affected file:
Resources/Private/Templates/UserBackend/List.html (UserBackend module, "Frontend Users")
Description
On a multi-language site where the default language has its own explicit path segment configured in the Site Configuration (e.g. base /en/ instead of an empty base at the domain root /), clicking the "Login as" button in the "Frontend Users" backend module does not log the admin in as the selected frontend user. Instead, the newly opened tab just shows the regular felogin login form.
No entry is written to the femanager log (neither STATUS_LOGIN_AS nor STATUS_LOGIN_AS_DENIED), which indicates that UserController::loginAsAction() is never actually entered.
Root cause
The "Login as" link is built as a hardcoded, root-relative URL string instead of going through TYPO3's site/language-aware routing:
<a href="/?type=1548943013&tx_femanager_impersonate[user]={user.uid}&tx_femanager_impersonate[redirectPid]={configPID}"
class="btn btn-default tx-feusermanager-icon-actions-system-backend-user-switch"
title="{f:translate(key: 'BackendListLoginAs')}" target="_blank">
<core:icon identifier="actions-system-backend-user-switch" />
</a>(Resources/Private/Templates/UserBackend/List.html, "Login as User" block)
Because the href always points at the bare domain root (/), it doesn't match any configured language base if the default language requires an explicit prefix. TYPO3 then performs an internal redirect to prepend the correct language segment (e.g. /en/) before the page/pageType can be resolved — and during that redirect the array-style GET parameters tx_femanager_impersonate[user] and tx_femanager_impersonate[redirectPid] are lost.
As a result, UserController::loginAsAction(User $user, int $redirectPid = 1) never receives a valid $user argument. Extbase's getArgumentMissingFallbackActions() (['loginAs' => 'list']) silently forwards to listAction instead — no exception, no log entry, and (prior to the 13.3.3 fix for "Gracefully handle missing required action arguments in controllers") no visible error at all. The visitor simply ends up on the target page without a valid frontend user session, where felogin then renders its login form.
Steps to reproduce
- Set up a TYPO3 13 site with a Site Configuration where the default language's base is not the domain root (e.g.
/en/), and at least one other language.
- Enable femanager's Impersonate feature via User TSconfig:
tx_femanager.UserBackend.enableLoginAs = 1.
- Open the "Frontend Users" backend module and click "Login as" for an offline, non-disabled frontend user.
- A new tab opens and shows the frontend login form instead of a logged-in session.
- Check the femanager Log backend view: no
STATUS_LOGIN_AS / STATUS_LOGIN_AS_DENIED entry was created for this attempt.
Expected behavior
Clicking "Login as" should log the admin in as the selected frontend user and redirect to the configured page (module.tx_femanager.settings.configPID), regardless of how the site's languages are configured.
Suggested fix
Build the link through a site/language-aware TYPO3 API (e.g. the f:uri.page ViewHelper) targeting configPID, instead of a hardcoded / string, so the correct language base segment is always included automatically:
<f:variable name="impersonateParams" value="{type: '1548943013', tx_femanager_impersonate: {user: user.uid, redirectPid: configPID}}" />
<a href="{f:uri.page(pageUid: configPID, additionalParams: impersonateParams, absolute: 1)}"
class="btn btn-default tx-feusermanager-icon-actions-system-backend-user-switch"
title="{f:translate(key: 'BackendListLoginAs')}" target="_blank">
<core:icon identifier="actions-system-backend-user-switch" />
</a>This resolves the target page's Site/Language via TYPO3's PageRouter, so the generated URL always contains whatever path segment the current site configuration requires for its default (or currently relevant) language.
Workaround (in the meantime)
Override UserBackend/List.html in a project extension via plugin.tx_femanager.view.templateRootPaths and replace the hardcoded anchor with the f:uri.page-based version above.
Bug: "Login as" link ignores site/language routing, losing GET parameters on multi-language sites
Environment
Resources/Private/Templates/UserBackend/List.html(UserBackendmodule, "Frontend Users")Description
On a multi-language site where the default language has its own explicit path segment configured in the Site Configuration (e.g. base
/en/instead of an empty base at the domain root/), clicking the "Login as" button in the "Frontend Users" backend module does not log the admin in as the selected frontend user. Instead, the newly opened tab just shows the regular felogin login form.No entry is written to the femanager log (neither
STATUS_LOGIN_ASnorSTATUS_LOGIN_AS_DENIED), which indicates thatUserController::loginAsAction()is never actually entered.Root cause
The "Login as" link is built as a hardcoded, root-relative URL string instead of going through TYPO3's site/language-aware routing:
(
Resources/Private/Templates/UserBackend/List.html, "Login as User" block)Because the
hrefalways points at the bare domain root (/), it doesn't match any configured language base if the default language requires an explicit prefix. TYPO3 then performs an internal redirect to prepend the correct language segment (e.g./en/) before the page/pageType can be resolved — and during that redirect the array-style GET parameterstx_femanager_impersonate[user]andtx_femanager_impersonate[redirectPid]are lost.As a result,
UserController::loginAsAction(User $user, int $redirectPid = 1)never receives a valid$userargument. Extbase'sgetArgumentMissingFallbackActions()(['loginAs' => 'list']) silently forwards tolistActioninstead — no exception, no log entry, and (prior to the 13.3.3 fix for "Gracefully handle missing required action arguments in controllers") no visible error at all. The visitor simply ends up on the target page without a valid frontend user session, where felogin then renders its login form.Steps to reproduce
/en/), and at least one other language.tx_femanager.UserBackend.enableLoginAs = 1.STATUS_LOGIN_AS/STATUS_LOGIN_AS_DENIEDentry was created for this attempt.Expected behavior
Clicking "Login as" should log the admin in as the selected frontend user and redirect to the configured page (
module.tx_femanager.settings.configPID), regardless of how the site's languages are configured.Suggested fix
Build the link through a site/language-aware TYPO3 API (e.g. the
f:uri.pageViewHelper) targetingconfigPID, instead of a hardcoded/string, so the correct language base segment is always included automatically:This resolves the target page's Site/Language via TYPO3's PageRouter, so the generated URL always contains whatever path segment the current site configuration requires for its default (or currently relevant) language.
Workaround (in the meantime)
Override
UserBackend/List.htmlin a project extension viaplugin.tx_femanager.view.templateRootPathsand replace the hardcoded anchor with thef:uri.page-based version above.